Executive brief
Empire is a post-exploitation and adversary emulation framework used by security teams for red team exercises. The vulnerability allows authenticated users to bypass file upload restrictions and write files to arbitrary locations on the server, potentially enabling unauthorized code execution and system compromise.
Technical details
The vulnerability is a path traversal flaw in Empire's upload endpoints that fails to properly validate the multipart filename parameter. Authenticated operators can inject path traversal sequences (e.g., ../ patterns) in filenames to escape the intended upload directory and write files to sensitive locations on the C2 server. This enables arbitrary file write and subsequent remote code execution. The issue affects versions before 6.7.1; patches are available in v6.7.1 and later.
Affected products
- BC Security Empire before 6.7.1
Timeline
- 2026-09-16: disclosed