IT SBIT Services
Schneeberger
DEEN
CVE tracker

SOCFortress CoPilot: Arbitrary file write via path traversal in ScoutSuite upload

CVE-2026-61738Critical 10.0

← All vulnerabilities

Summary

SOCFortress CoPilot before 0.1.77 passes the uploaded filename of the ScoutSuite GCP report route to the file writer without sanitization. An authenticated admin or analyst can use path traversal in the filename to write the uploaded JSON content outside the report directory. The backend runs as root, so host files can be overwritten and operation disrupted; the demonstrated impact does not establish direct code execution, although the advisory is titled RCE. The CNA and NVD rate the CVE 10.0 (CVSS 3.1), while VulDB rates it 9.9.

Affected

  • SOCFortress CoPilot versions before 0.1.77
  • VulDB lists the range as up to 0.1.76

Fixed in

  • Version 0.1.77 removes caller-controlled filenames from the affected route

Workaround

  • No vendor-documented workaround.
  • Until the update is applied, limit the admin and analyst accounts that can use the ScoutSuite upload route.

Exploitation

  • OffSeq reports no known exploitation.
  • No public proof of concept or CISA KEV entry was found; the search was limited.

Our recommendation

  • Upgrade CoPilot to 0.1.77 or later as a priority.
  • Check whether CoPilot is reachable from the internet and restrict access.
  • Review the backend host for unexpected files written outside the scoutsuite-report directory.
  • Review the admin and analyst accounts and remove unneeded access.
  • Check the related CVE-2026-61730 (unauthenticated exposure of the scoutsuite-report directory) at the same time.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:20.

Original description (NVD)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.

NVD references (6)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.