CVE-2026-92153

Deferred Deferred - Pending Action

Path Traversal in F Prime Framework

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92153

EUVD

EUVD-2026-101468

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	fprime	< 4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

CVE-2026-92153 is an arbitrary file write vulnerability in the F Prime framework's Svc::FileUplink component. It occurs because the component accepts an attacker-controlled destination path from Fw::FilePacket::StartPacket without validation, canonicalization, or confinement to a safe upload directory. This allows attackers to create or overwrite files at any writable path on the filesystem.

Detection Guidance

Check for unauthorized file writes in writable directories by monitoring file system changes. Look for unexpected files in /tmp or other common locations. Review logs for Svc::FileUplink component activity. Use tools like find or auditd to detect file modifications outside expected directories.

Impact Analysis

This vulnerability can lead to arbitrary file creation or overwrite in writable locations, modification of trusted local files depending on deployment layout, and potential integrity and availability issues. If the flight software runs with elevated privileges, the impact could be greater.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized file access or modification. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Unauthorized file writes could expose or alter sensitive data, violating these regulations.

Mitigation Strategies

Upgrade to F Prime version 4.3.0 or later. Restrict Svc::FileUplink to use a dedicated allowlisted base directory for uploads. Validate and canonicalize all destination paths before file operations. Reject absolute paths unless safely constrained. Implement strict path traversal checks.

Hi! I’m here to help you understand CVE-2026-92153. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70