What’s Vulnerable › Vulnerabilities

CVE-2024-46977: OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-02 · updated 2026-06-17
• Weakness: CWE-22

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.

Affected products

• OpenC3 cosmos: before 5.19.0 — fixed in 5.19.0

How to fix

Upgrade to a fixed version: OpenC3 cosmos 5.19.0. Check the vendor advisory for mitigations.

References

• https://github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8
• https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS

Get alerted when CVE-2024-46977 or the next vulnerability affects your stack