CVE-2026-61738: SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-22

Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.

Summary

SOCFortress CoPilot before 0.1.77 has a path traversal flaw in POST /api/scoutsuite/generate-gcp-report: the raw multipart filename is joined to the report directory without sanitization, letting admin or analyst users write attacker-supplied JSON outside the intended folder. Because the backend runs as root, this allows host file overwrite (content limited to valid GCPScoutSuiteJSON) and can disrupt application operation; the researcher demonstrated root-owned writes into the application source directory. No exploitation in the wild is reported and it is not in CISA KEV. Upgrade to 0.1.77, which removes caller-controlled filenames from the affected route; until then, restrict access to the endpoint and avoid running the backend as root.

تحتوي إصدارات SOCFortress CoPilot الأقدم من 0.1.77 على ثغرة اجتياز مسار في POST /api/scoutsuite/generate-gcp-report، إذ يُدمج اسم الملف الخام القادم من multipart مع مجلد التقارير دون تعقيم، ما يتيح لمستخدمي admin أو analyst كتابة JSON يقدمه المهاجم خارج المجلد المقصود. ولأن الواجهة الخلفية تعمل بصلاحيات root، يتيح ذلك استبدال ملفات المضيف (بمحتوى محدود بـ GCPScoutSuiteJSON الصالح) وقد يعطّل عمل التطبيق؛ وقد أثبت الباحث كتابة ملفات مملوكة لـ root داخل مجلد مصدر التطبيق. لا توجد تقارير عن استغلال فعلي في البرية وليست مدرجة في CISA KEV. الحل هو الترقية إلى 0.1.77 التي تزيل أسماء الملفات التي يتحكم بها المستدعي من المسار المتأثر؛ وإلى حين ذلك، قيّدوا الوصول إلى نقطة النهاية وتجنبوا تشغيل الواجهة الخلفية بصلاحيات root.

Affected products

socfortress CoPilot: before 0.1.77

References

Get alerted when CVE-2026-61738 or the next vulnerability affects your stack