CVE-2026-67972

Received Received - Intake

Path Traversal in NASA cFS v7.0.1

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: MITRE

Description

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-67972

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	cfs	7.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1. It allows attackers to control where received content and data is stored, which could lead to information disclosure.

Impact Analysis

An attacker could exploit this to store malicious data in unintended locations, potentially leading to unauthorized access to sensitive information or system compromise.

Compliance Impact

The vulnerability allows attackers to control where received content and data is stored, which could lead to unauthorized access or disclosure of sensitive information. This may impact compliance with standards like GDPR or HIPAA by increasing the risk of data breaches or improper data handling.

Mitigation Strategies

Update NASA cFS to the latest version to address the issue in CF_CFDP_RecvMd(). Disable unnecessary network services and restrict access to cFS components. Monitor system logs for unusual data storage activities.

Hi! I’m here to help you understand CVE-2026-67972. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70