Executive brief
Scirius is a web application used to manage firewall rulesets and perform threat hunting. A vulnerability in the PCAP file upload feature allows regular users to write malicious JSON files to arbitrary locations on the server, potentially enabling remote code execution or system compromise if attackers can control which files the system loads.
Technical details
This is a path traversal vulnerability combined with arbitrary file write in the PCAP filestore upload endpoint. The vulnerable component fails to sanitize the _id field in uploaded documents, allowing attackers to inject path traversal sequences (such as "../") to escape the intended upload directory. Authenticated users with the default User role can exploit this to write JSON files with .json extensions to arbitrary filesystem locations running as root. The attack requires network access and authentication as a standard user; no privilege escalation is needed since the upload process runs with elevated privileges. A successful exploit enables arbitrary file write as root, which could lead to remote code execution depending on how the application processes stored JSON files.
Affected products
- Stamus Networks Scirius through 3.8.0
Timeline
- 2026-09-16: disclosed: CVE-2026-92604 published