Live › vulnerability › CVE-2026-61738
SOCFortress CoPilot's GCP ScoutSuite report upload passes the raw multipart filename straight into a file path without checking it, so a path-traversal filename can write uploaded JSON outside the report directory. An admin or analyst account can overwrite host files, and the reported backend runs as root, which can disrupt the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running SOCFortress CoPilot before 0.1.77 where admin or analyst users can reach the GCP ScoutSuite report upload route. The flaw lives in how the backend builds file paths from the upload filename, so any deployment on that version with the route reachable by those roles is exposed. Deployments that have already moved to 0.1.77 or that never expose the backend to analyst users can skip it.
No product ranges from the sources yet.
0.1.77.POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py.0.1.77 or later, which removes caller-controlled filenames from the affected route.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as GCPScoutSuiteJSON, but passes raw file.filename from the multipart header to save_file_to_directory in backend/app/integrations/scoutsuite/services/scoutsuite.py. The writer combines this filename with scoutsuite-report using os.path.join without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.
This page as .md · .json · in your agent: get_signal("CVE-2026-61738")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.