CyberRota Analysis
AI-GeneratedBC Security Empire versions prior to 6.7.1 are vulnerable due to inadequate validation of the multipart filename parameter in upload endpoints, enabling authenticated users to exploit path traversal vulnerabilities. This flaw allows attackers to write malicious files to arbitrary locations on the command-and-control server, potentially leading to unauthorized code execution. Organizations using this software should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.