Skip to content
Heist/ feed
Back to feed
High

BC Security Empire before 6.7.1 Path Traversal File Upload RCE

Type: advisorySources: OSV

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-92748
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:33 UTC · Revision 1

Source evidence

BC Security Empire before 6.7.1 Path Traversal File Upload RCE

core-osv · Original source

Published 16 Sept 2026, 20:32 UTC

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

osv:CVE-2026-92748
Complete source record
{
  "id": "cd7d26f14fa394b707f63eb956f6c93c0cb8272a6e14b9ccdd9626372211cc98",
  "url": "https://osv.dev/vulnerability/CVE-2026-92748",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "BC Security Empire before 6.7.1 Path Traversal File Upload RCE",
    "summary": "BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.",
    "evidence": "osv:CVE-2026-92748",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-92748",
      "aliases": [
        "CVE-2026-92748"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/bc-security/empire",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ca5b77497f82011646422c38dfe67b9b8ebdd85f"
                },
                {
                  "fixed": "c33a626316cb20bc8ed707e03a22d324d5d4762a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "6.7.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "c33a626316cb20bc8ed707e03a22d324d5d4762a"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ca5b77497f82011646422c38dfe67b9b8ebdd85f"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v6.7.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v6.6.0",
            "v6.5.0",
            "v6.4.1",
            "v6.3.0",
            "v6.2.1",
            "v6.2.0",
            "v6.1.3",
            "v6.1.2",
            "v6.0.3",
            "v6.0.2",
            "v6.0.1",
            "v6.0.0",
            "v5.12.2",
            "v5.12.1",
            "v5.12.0",
            "v5.11.7",
            "v5.11.6",
            "v5.11.5",
            "v5.11.4",
            "v5.11.2",
            "v5.10.3",
            "v5.10.2",
            "v5.10.1",
            "v5.9.5",
            "v5.9.4",
            "v5.9.3",
            "v5.9.2",
            "v5.9.1",
            "v5.8.4",
            "v5.8.3",
            "v5.8.2",
            "v5.8.1",
            "v5.7.3",
            "v5.6.4",
            "v5.6.3",
            "v5.5.4",
            "v5.5.3",
            "v5.4.2",
            "v5.2.2",
            "v5.1.2",
            "v5.0.4",
            "v5.0.3",
            "v4.10.0",
            "v4.9.0",
            "v4.8.4",
            "v4.8.3",
            "v4.8.1",
            "v4.8.0",
            "v4.7.3",
            "v4.7.1",
            "v4.6.1",
            "v4.5.5",
            "v4.5.4",
            "v4.5.3",
            "v4.4.1",
            "v4.3.3",
            "v4.2.0",
            "v4.1.3",
            "v4.0.2",
            "v4.0.1",
            "v3.8.2",
            "v3.7.2",
            "v3.6.3",
            "v3.6.2",
            "v3.6.1",
            "v3.6.0",
            "v3.5.2",
            "v3.5.1",
            "v3.5.0",
            "v3.4.0",
            "v3.3.4",
            "v3.3.3",
            "v3.3.2",
            "v3.3.1",
            "v3.3.0",
            "v3.2.3",
            "v3.2.2",
            "v3.2.1",
            "v3.2.0",
            "v3.1.5",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5",
            "v3.0.4",
            "v3.0.3",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "2.5",
            "2.4",
            "2.0",
            "1.5",
            "1.4",
            "1.3.1",
            "1.3",
            "1.2.1",
            "1.2",
            "1.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92748.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.011542830Z",
      "provider": "osv",
      "references": [
        "https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92748.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-92748",
        "https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traversal-file-upload-rce",
        "https://github.com/BC-SECURITY/Empire/issues/824",
        "https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d4762a",
        "https://github.com/BC-SECURITY/Empire",
        "https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_service.py#L148-L193"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92748.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-92748",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500048,
  "published_at": "2026-09-16T20:32:22.03+00:00"
}