Critical, CVSS 9.1PyPIAmendedPublished
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
CVE-2026-47731 · GHSA-p462-prxw-mjx4
- Affected
- PyPI ait-core >= 3.1.0, <= 3.1.0; < 2.6.1
- Fixed in
- 3.1.12.6.1· Vendor fix available
- Issue
- 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the code blindly trusts path‑related form fields, a remote client can: - Bypass the configured log root and direct BSC to log to arbitrary filesystem paths (path traversal / directory escape), and - Append attacker‑controlled data to those files, using the privileges of theait-bsc process. There are two ways for a remote attacker to trigger this: 1. If the attacker has access to the network where ait-bsc is deployed (a reason for that could be that the ports are publicly accessible), the payloads can be directly sent to the server to trigger the arbitrary file append. This type of attack is demonstrated in pythonpoc.py. 2. Even if the attacker does not have direct access to the network because the software is running in a local network, it is possible to exploit this if a bad actor in that network opens an attacker-controlled website…
Recommended action: Upgrade to 3.1.1 or 2.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.