PHP2Shell : See if you’re affected with a free external attack surface scan. Click Here > 

Back
New CVE Detected

CVE-2026-85199 – Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete) – Eclipse aeriOS

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-85199 is a path traversal vulnerability (CWE-22/CWE-23) in the REST API of Eclipse aeriOS Self-orchestrator versions prior to 1.2.1. User-controlled resource identifiers used when creating, updating, or deleting Self-orchestrator resources are concatenated directly into filesystem paths without validation or normalization, allowing an attacker to escape the intended storage directory. The flaw is rated HIGH severity (CVSS 8.8) and is especially dangerous because the affected API endpoints require no authentication and the Self-orchestrator service runs with elevated (root) privileges.

Technical details

  • Root cause: Rule/fact identifiers supplied by API clients (e.g., the name field on rules, the fact id on data entries) are concatenated directly into filesystem paths used to read, write, or delete .json files, with no path.basename() normalization, regex restriction, or containment check to ensure the resolved path stays within the intended directory.
  • Affected endpoints: POST /rules, PUT /rule, DELETE /rule (query parameter), and POST /data — each passes an attacker-controlled identifier into a filesystem path.
  • Trigger conditions: An attacker sends a crafted identifier containing directory traversal sequences (e.g., ../../../etc/evil) to one of the affected endpoints.
  • Attack vector: Network — the vulnerable REST API listens on 0.0.0.0:8001 and enforces no authentication (CWE-306, Missing Authentication), so any network-reachable attacker can exploit it directly.
  • Impact: Because the process runs as root, exploitation allows arbitrary creation, modification, or deletion of files outside the intended resource directory, limited to .json-suffixed files by the API’s forced file extension. This can result in data tampering, denial of service, or corruption of system/application configuration files.

Affected software

  • Eclipse aeriOS Self-orchestrator, version 1.2.0 (the only formally released version at the time of disclosure)
  • All development commits from 63993c83fb71bb2c4981731b4980ff93c72a6750 up to (but not including) the fix commit c42da0014069528d149ff9f8b038ac93c38a766c
  • Fixed in version 1.2.1

Severity

  • CVSS Score: 8.8 (HIGH)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
  • Key metrics: Network attack vector, low attack complexity, no privileges or user interaction required, high integrity and availability impact.

Mitigation and recommended actions

  • Immediate: Upgrade Eclipse aeriOS Self-orchestrator to version 1.2.1 or later, which adds a ^[^/]*$ pattern restriction on the rule name field in the API schema and sanitizes fact identifiers (stripping / characters) before they are used to construct file paths.
  • If unable to patch immediately:
    • Restrict network access to the Self-orchestrator API (port 8001) to trusted management networks only; do not expose it directly to untrusted networks.
    • Front the API with an authenticating reverse proxy/API gateway until the service itself enforces authentication.
    • Run the Self-orchestrator container/process as a non-root user and avoid hostNetwork mode in Kubernetes/Helm deployments to limit blast radius if exploited.
    • Monitor for and block requests to /rules, /rule, and /data endpoints containing path traversal sequences (e.g., ../) via a WAF or ingress filtering rule.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge