CVE-2026-85456CWE-22path-traversal

CVE-2026-85456

Medium · published September 4, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00229 · 12.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T03:17Z
Affected products (1)
ProductVersionsFixed in
mit/moos-ivp< 24.8.124.8.1
References (5)
https://github.com/moos-ivp/moos-ivp · [email protected]https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp#L189 · [email protected]https://github.com/moos-ivp/moos-ivp/commit/6f0619e905b325d6b88f76425673045c6e4f6f94 · [email protected]https://github.com/moos-ivp/moos-ivp/pull/137 · [email protected]https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alog-splitting-path-traversal-on-windows · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 22:38Z
    MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows
    cvelistv5