Executive brief
A security vulnerability exists in a Rapid7 plugin used for compressing files within the InsightConnect automation platform. An authorized user could potentially cause the system to write files to incorrect locations on the server, leading to file corruption. While this could disrupt operations or damage system files, the attacker cannot control the content being written, which limits the overall risk.
Technical details
A path traversal vulnerability (CWE-22) exists in the create_archive function of the Rapid7 InsightConnect Compression Plugin for Linux. The flaw stems from insufficient validation of filename input, allowing an authenticated attacker with high privileges to specify paths outside of the intended directory. While the attacker can trigger a write operation to these paths, they lack control over the actual file content, restricting the impact to integrity and availability through file corruption. The vulnerability is addressed in version 2.0.3.
Affected products
- Rapid7 InsightConnect Compression Plugin < 2.0.3
Timeline
- 2026-06-25: advisory: NVD publication date
- 2026-06-24: disclosed: Initial disclosure by Rapid7