CVE-2026-85199Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API.
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse aeriOS. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process. The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.
- CVSS
- 8.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-22, CWE-23, CWE-206
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- eclipse
- NVD analysis
- Deferred
- Record last updated
- Sep 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Eclipse Foundation Eclipse aeriOS eclipse_foundation:eclipse_aerios (from the name) | from 63993c83fb71bb2c4981731b4980ff93c72a6750 before c42da0014069528d149ff9f8b038ac93c38a766c | CNA record |
References
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/832
- https://github.com/eclipse-aerios/self-orchestrator/commit/c42da0014069528d149ff9f8b038ac93c38a766c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.