# CVE-2026-47731: NASA AMMOS AIT-Core path traversal in Binary Stream Capture

Source: https://junglewise.ai/threats/cve-2026-47731-nasa-ammos-ait-core-path-traversal-in-binary-stream-capture  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-47731 · Severity: critical · CVSS 9.1 · Published 2026-07-21

NASA's AMMOS Instrument Toolkit (AIT-Core), a software suite used for managing satellite and CubeSat missions, contains a vulnerability in its data capture component. An unauthenticated attacker can remotely bypass security restrictions to write or append data to any file on the host system. This could lead to system crashes, data corruption, or potentially full system takeover if the attacker modifies critical scripts or executable files.

Technologies: [ait-core (PyPI)](https://junglewise.ai/threats/technologies/ait-core). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47731 being exploited in the wild.

**How severe is CVE-2026-47731?** Critical severity, with a CVSS score of 9.1, published 21 July 2026.

**Which products and versions are affected?** Nasa AMMOS Instrument Toolkit Core < 2.6.1, >= 3.1.0, < 3.1.1; ait-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1,introduced=3.1.0,fixed=3.1.1, ECOSYSTEM:introduced=3.1.0,fixed=3.1.1.

**Is there a fix for CVE-2026-47731?** Yes. ait-core (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47731 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47731?** Check whether you run Nasa AMMOS Instrument Toolkit Core or ait-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ait-core (PyPI): upgrade to 3.1.1 or later

  ```sh
  pip install "ait-core>=3.1.1"
  ```


## Technical details

A path traversal vulnerability exists in the Binary Stream Capture (BSC) component of AIT-Core due to insufficient validation of path-related fields in the `StreamCaptureManagerServer` unauthenticated HTTP API. The `_add_logger_by_name` handler blindly trusts form fields such as `log_dir_path` and `path`, passing them to `os.path.join()`. An attacker can provide absolute paths or traversal sequences to escape the configured log directory. By directing the BSC process to log to sensitive files (e.g., Python scripts or system configurations), an attacker can append arbitrary data, leading to data corruption or Remote Code Execution (RCE). The vulnerability can be exploited directly via network requests or indirectly via Cross-Site Request Forgery (CSRF) if a user in the local network visits a malicious website. Fixed in versions 2.6.1 and 3.1.1.

## Affected products

- NASA-AMMOS AIT-Core 2.x before 2.6.1, 3.1.0

## Identifiers

- CVE-2026-47731
- GHSA-p462-prxw-mjx4
- PYSEC-2026-265

## Timeline

- 2026-05-19: patched: Versions 2.6.1 and 3.1.1 released
- 2026-07-21: advisory: NVD publication date

## References

- [https://github.com/NASA-AMMOS/AIT-Core/releases/tag/2.6.1](https://github.com/NASA-AMMOS/AIT-Core/releases/tag/2.6.1)
- [https://github.com/NASA-AMMOS/AIT-Core/releases/tag/3.1.1](https://github.com/NASA-AMMOS/AIT-Core/releases/tag/3.1.1)
- [https://github.com/NASA-AMMOS/AIT-Core/security/advisories/GHSA-p462-prxw-mjx4](https://github.com/NASA-AMMOS/AIT-Core/security/advisories/GHSA-p462-prxw-mjx4)

## Related threats

- [PYSEC-2026-1113 - NASA AIT-Core uses unencrypted channels to exchange data over the network](https://junglewise.ai/threats/cve-2024-35061-nasa-ait-core-uses-unencrypted-channels-to-exchange-data-over-the)
- [NASA AIT-Core vulnerable to remote code execution](https://junglewise.ai/threats/cve-2024-35059-nasa-ait-core-vulnerable-to-remote-code-execution)
- [NASA AIT-Core vulnerable to remote code execution](https://junglewise.ai/threats/cve-2024-35057-nasa-ait-core-vulnerable-to-remote-code-execution)
- [NASA AIT-Core vulnerable to remote code execution](https://junglewise.ai/threats/cve-2024-35058-nasa-ait-core-vulnerable-to-remote-code-execution)
- [NASA AIT-Core vulnerable to SQL Injection](https://junglewise.ai/threats/cve-2024-35056-nasa-ait-core-vulnerable-to-sql-injection)