CVE-2026-85199
Received Received - Intake

Path Traversal in Eclipse aeriOS Self-orchestrator

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Eclipse Foundation

Description
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process. The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85199
EUVD
EUVD-2026-70479

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse aerios_self-orchestrator to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-206 The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85199 is a path traversal vulnerability in Eclipse aeriOS Self-orchestrator versions before 1.2.1. The REST API uses user-controlled identifiers directly in filesystem paths without validation. An unauthenticated attacker can craft identifiers with path traversal sequences like ../ to write or delete files outside intended directories, limited only by the process filesystem permissions.

Detection Guidance

Check if your aeriOS Self-orchestrator version is below 1.2.1 by running: docker inspect <container_name> | grep -i version. Inspect API endpoints for POST /rules, PUT /rule, DELETE /rule, and POST /data in your network traffic logs for unusual path traversal patterns like ../ in identifiers.

Impact Analysis

An attacker could exploit this to overwrite or delete critical files such as package.json or system files, leading to denial of service or integrity loss. The impact is higher if the container runs with elevated privileges as root, allowing file operations across the host system.

Mitigation Strategies

Upgrade to aeriOS Self-orchestrator version 1.2.1 or later immediately. If upgrading is not possible, restrict network access to the API endpoints and ensure the container does not run with elevated privileges or hostNetwork: true.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart