CVE-2026-8662 Details
Description
Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.
A path traversal vulnerability has been identified in the Rapid7 InsightConnect Compression Plugin, specifically in the create_archive function for Linux users. This vulnerability allows authenticated attackers to write to unintended file paths by exploiting the filename parameter, leading to file corruption since the attacker cannot control the content. The issue arises from inadequate validation of the filename input, which fails to prevent traversal sequences that could manipulate file paths.
Users can update to version 2.0.4 of the Rapid7 InsightConnect Compression Plugin, which addresses the path traversal vulnerability by implementing proper validation of the filename parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://extensions.rapid7.com/extension/compression | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rapid7 insightconnect compression | < 2.0.3 |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |