CyberRota Analysis
AI-GeneratedAn arbitrary file write vulnerability exists in Scirius versions up to 3.8.0, allowing users with default roles to upload malicious JSON content that can exploit path traversal sequences. This enables attackers to write files with a .json extension to arbitrary locations on the filesystem, potentially compromising the system's integrity. Organizations using Scirius should prioritize patching this vulnerability to mitigate the risk of unauthorized file access and system exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.