CVE-2026-92604 Details
Description
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
An arbitrary file write vulnerability has been identified in Scirius Community Edition versions through 3.8.0. The issue resides in the PCAP filestore upload endpoint, where users with the default 'User' role can upload JSON files containing path traversal sequences. These sequences can escape the intended directory, allowing files with a .json extension to be written to arbitrary locations on the filesystem. The vulnerability arises because the application, running as root in the official Docker deployment, does not properly sanitize the filename before saving the uploaded file.
Sanitize the filename before constructing the file path to ensure it cannot escape the designated directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/scirius.md | CISA-ADP | ExploitTechnical Description |
| https://github.com/geo-chen/oss/blob/main/scirius.md | [email protected] | ExploitTechnical Description |
| https://github.com/StamusNetworks/scirius | [email protected] | ProductSource CodeVendor |
| https://github.com/StamusNetworks/scirius/blob/3bb49d383f4801b79e6356f9de9f25806afe0311/suricata/rest_api.py#L105-L113 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/scirius-through-3.8.0-arbitrary-file-write-via-pcap-upload | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| StamusNetworks Scirius | <= 3.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | New CVE Received | [email protected] |
| Sep 16, 2026 | CVE Modified | CISA-ADP |