# CVE-2026-42085: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.

Source: https://junglewise.ai/threats/cve-2026-42085-openc3-cosmos-path-traversal-in-save-tool-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-42085 · Severity: medium · CVSS 4.3 · Published 2026-05-04

OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, contains a vulnerability that allows users to save configuration files in unauthorized locations. An attacker with low-level access could exploit this to overwrite critical plugin data or create unauthorized file structures. This could lead to the corruption of plugin functionality or the modification of system configurations.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos), [openc3 (PyPI)](https://junglewise.ai/threats/technologies/pypi-openc3), [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3). Vendors: [Openc3](https://junglewise.ai/threats/vendors/openc3), [PyPI](https://junglewise.ai/threats/vendors/pypi), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-42085 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42085 being exploited in the wild.

**How severe is CVE-2026-42085?** Medium severity, with a CVSS score of 4.3, published 4 May 2026.

**Which products and versions are affected?** Openc3 Cosmos < 6.10.5, >= 7.0.0.pre.rc1, < 7.0.0-rc3; openc3 (PyPI) ECOSYSTEM:introduced=0,fixed=6.10.5; openc3 (RubyGems) ECOSYSTEM:introduced=0,fixed=6.10.5.

**Is there a fix for CVE-2026-42085?** Yes. openc3 (PyPI): upgrade to 6.10.5 or later; openc3 (RubyGems): upgrade to 6.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42085 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42085?** Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openc3 (PyPI): upgrade to 6.10.5 or later

  ```sh
  pip install "openc3>=6.10.5"
  ```

- openc3 (RubyGems): upgrade to 6.10.5 or later

  ```sh
  bundle update openc3
  ```


## Technical details

A path traversal vulnerability exists in the `save_tool_config()` function within `local_mode.rb`. While the application attempts to mitigate traversal by canonicalizing filenames to absolute paths, it fails to restrict writes to the specific intended subdirectory, allowing files to be saved anywhere within the broader `OPENC3_LOCAL_MODE_PATH` (the `/plugins` directory tree). An authenticated attacker with network access can use `../` sequences in configuration filenames to escape the intended directory and overwrite files belonging to other plugins. This issue is addressed in versions 6.10.5 and 7.0.0-rc3.

## Affected products

- OpenC3 COSMOS < 6.10.5, >= 7.0.0.pre.rc1, < 7.0.0-rc3

## Identifiers

- CVE-2026-42085
- GHSA-4jvx-93h3-f45h
- PYSEC-2026-2243

## Timeline

- 2026-04-20: disclosed
- 2026-04-22: advisory: GitHub Advisory published
- 2026-05-04: other: NVD published

## References

- [https://api.github.com/users/ctrlsill](https://api.github.com/users/ctrlsill)
- [https://github.com/ctrlsill](https://github.com/ctrlsill)
- [https://api.github.com/users/ctrlsill/gists%7B/gist_id%7D](https://api.github.com/users/ctrlsill/gists%7B/gist_id%7D)
- [https://api.github.com/users/ctrlsill/repos](https://api.github.com/users/ctrlsill/repos)
- [https://avatars.githubusercontent.com/u/86782008?v=4](https://avatars.githubusercontent.com/u/86782008?v=4)
- [https://api.github.com/users/ctrlsill/events%7B/privacy%7D](https://api.github.com/users/ctrlsill/events%7B/privacy%7D)

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.](https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url)
- [OpenC3 COSMOS stored cross-user XSS in BUTTON widget](https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS SQL injection in QuestDB Time-Series Database](https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database)