CVE-2026-92748CWE-22path-traversal

CVE-2026-92748

High · published September 17, 2026

CVSS v3.1

8.8

EPSS

Percentile

56.8

In the wild

Unconfirmed

What it is

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00819 · 56.8th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-09-17T01:17Z

References (7)

https://github.com/BC-SECURITY/Empire · [email protected]https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_service.py#L148-L193 · [email protected]https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d4762a · [email protected]https://github.com/BC-SECURITY/Empire/issues/824 · [email protected]https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1 · [email protected]https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traversal-file-upload-rce · [email protected]https://github.com/BC-SECURITY/Empire/issues/824 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

18 SEP 04:02Z
EPSS moved — → 1%
epss
16 SEP 20:32Z
BC Security Empire before 6.7.1 Path Traversal File Upload RCE
cvelistv5