Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61738updated 30 Oct 2026, 15:18 UTC

CoPilot security tool lets users overwrite server files via crafted upload name

A logged-in admin or analyst can upload a report with a specially crafted file name that tricks the server into saving the file somewhere else on the system, including places it should never reach. This can overwrite important files and bre

Fixed in 0.1.77 · out Official source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes0.1.77 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Logged-in analystAdmin or analyst account required
  2. 2Crafted uploadFilename contains path traversal sequences
  3. 3Unsafe path joinNo sanitization or containment check
  4. 4File writtenSaved outside the report directory
  5. 5Host files overwrittenBackend runs as root
  6. ResultHost files overwritten, application disrupted

What happened

In SOCFortress CoPilot before 0.1.77, the POST /api/scoutsuite/generate-gcp-report endpoint passes the uploaded file's raw filename into os.path.join without sanitizing path traversal sequences or checking the resolved path stays inside the report directory. The backend runs as root, so traversal writes can land outside the intended directory, including into the application source directory.

Why it is dangerous: An authenticated admin or analyst can overwrite host files on the server, which can disrupt or take down the security platform and undermine the integrity of the system it monitors. The impact is limited to the accepted JSON content and does not by itself prove arbitrary code execution.

Are you affected?

You are affected if you run SOCFortress CoPilot earlier than version 0.1.77 and allow admin or analyst users to use the GCP ScoutSuite report upload feature.

SOCFortress CoPilot versions prior to 0.1.77

What to do

  1. Update SOCFortress CoPilot to version 0.1.77 or later
  2. Until updated, restrict access to the ScoutSuite GCP report endpoint to trusted users only
  3. Review the backend for unexpected or modified files outside the report directory

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61738
CVSS
10 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

CoPilot security tool lets users overwrite server files via crafted upload name · Zero Radar