CVE-2026-78299
Received Received - Intake

Arbitrary File Write in Eclipse Embedded CDT via Malicious CMSIS-Pack

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Eclipse Foundation

Description
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-78299
EUVD
EUVD-2026-77465

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
eclipse embedded_cdt From 6.0 (inc) to 6.7 (inc)
eclipse embedded_cdt From 2.3.1-201407120554 (inc) to 6.7.0 (inc)
eclipse embedded_cdt 6.8.0
eclipse simrel 2026-09
eclipse ide_for_embedded_c_c++_developers 2026-09
eclipse embedded_cdt to 6.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability, CVE-2026-78299, is a Zip Slip issue in Eclipse Embedded CDT versions 2.3.1-201407120554 to v6.7.0. It occurs during CMSIS-Pack archive extraction when the InstallJob.unzip() method writes files to paths constructed from ZipEntry names without validating path containment. Attackers can exploit this by including path traversal sequences in malicious .pack archives to write files outside the intended directory, enabling arbitrary file writes and potential code execution.

Detection Guidance

Check for suspicious CMSIS-Pack archives in your Eclipse Embedded CDT installation directory. Look for files with path traversal sequences like ../../../../ in their names. Review logs for arbitrary file writes outside the expected pack extraction folder. Use tools like 'unzip -l' to inspect pack archives for malicious entries before extraction.

Impact Analysis

This vulnerability allows attackers to write arbitrary files to any location on disk where the Eclipse process has write permissions. This could lead to overwriting critical system files, modifying startup scripts, or installing malware. Users installing compromised CMSIS Packs from untrusted sources or via unsecured HTTP connections are at risk.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized file writes. Attackers could overwrite critical system or application files, leading to data breaches or unauthorized access to sensitive information. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information; this flaw could undermine those protections by allowing arbitrary file manipulation.

Mitigation Strategies

Upgrade Eclipse Embedded CDT to the latest version that includes a fix for this issue. Avoid downloading CMSIS-Pack archives from untrusted sources. Use HTTPS for pack downloads and verify archive integrity with checksums or signatures if available. Restrict write permissions for the Eclipse process to minimize potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78299. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart