CVE-2026-79653

Deferred Deferred - Pending Action

Path Traversal in Eclipse SW360 File Upload

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: Eclipse Foundation

Description

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-79653

EUVD

EUVD-2026-67130

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	sw360	19.0.0
eclipse	sw360	19.1.0
eclipse	sw360	19.2.0
eclipse	sw360	20.0.0
eclipse	sw360	20.1.0
eclipse	sw360	From 2021 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects Eclipse SW360 versions 19.0.0 to 20.1.0 when configured to store attachments in the filesystem. An attacker with authenticated write access can manipulate the filename during upload to perform path traversal, writing arbitrary files to any location accessible by the backend process. The issue stems from unsanitized filenames in the filesystem storage feature.

Detection Guidance

To detect this vulnerability, check if Eclipse SW360 is configured with enable.attachment.store.to.file.system enabled. Inspect the SW360 configuration files for this setting. Additionally, review file system permissions and logs for suspicious file writes outside intended directories.

Impact Analysis

An attacker could overwrite critical system files, inject malicious code, or disrupt services by writing files to unauthorized locations. This requires authenticated access with write permissions and the filesystem attachment feature enabled. The impact includes potential remote code execution or data tampering if the backend process has sufficient privileges.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if sensitive data is exposed or altered due to arbitrary file writes. Organizations using affected SW360 versions must address this to maintain regulatory compliance.

Mitigation Strategies

Disable the enable.attachment.store.to.file.system configuration key in SW360. Alternatively, update to a fixed version of Eclipse SW360 that includes the security patch for path traversal handling.

Hi! I’m here to help you understand CVE-2026-79653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70