Executive brief
Tencent's MSEC is a backend service platform used for managing microservices, load balancing, and infrastructure operations. A critical flaw allows unauthenticated attackers to bypass access controls using path traversal (../ sequences) in POST requests, gain root-level access, and execute arbitrary code by uploading malicious scripts. This poses an immediate risk to any production system running MSEC, enabling complete compromise of backend infrastructure and data.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in MSEC's request handling. An unauthenticated attacker can craft a POST request containing ../ sequences to escape directory restrictions and access protected resources or upload files with elevated privileges. No authentication is required and the attack is trivial to execute over the network. An attacker can upload a webshell and execute code as root, achieving complete system compromise. No fix is available; the repository was archived by Tencent in October 2019 and remains unfixed.
Affected products
- Tencent Mass Service Engine in Cluster (MSEC) all versions
Timeline
- 2026-09-15: disclosed
- other: Repository archived October 2019, no fix planned