Executive brief
Eclipse Embedded CDT is an IDE plugin for embedded C/C++ development. A flaw in how it extracts CMSIS hardware definition packages allows attackers to write arbitrary files to any location on the developer's system—potentially including startup scripts or system binaries—if the developer installs a malicious or compromised pack from a vendor or network intermediary.
Technical details
The vulnerability is a Zip Slip path traversal flaw (CWE-22) in the `InstallJob.unzip()` method. When extracting CMSIS-Pack `.pack` archive files, the code appends raw `ZipEntry.getName()` values directly to the destination folder path without canonicalizing or validating that the resulting path remains within the pack directory. An attacker-controlled archive can include entries with directory traversal sequences (e.g., `../../../../../../home/user/.bashrc`) that escape the intended extraction directory. The archive URL is fetched from the vendor's `.pdsc` manifest, making any compromised vendor, MITM on unencrypted HTTP pack URLs, or network attacker a potential source. The fix was released in version 6.8.0 and patches the containment check during extraction.
Affected products
- Eclipse Embedded CDT 6.0 to 6.7
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Eclipse Embedded CDT 6.8.0, Eclipse IDE for Embedded C/C++ Developers 2026-09