Vulnerability Description
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/moos-ivp/moos-ivp
- https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed247297
- https://github.com/moos-ivp/moos-ivp/commit/6f0619e905b325d6b88f76425673045c6e4f
- https://github.com/moos-ivp/moos-ivp/pull/137
- https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alog-splitting-path
FAQ
What is CVE-2026-85456?
CVE-2026-85456 is a vulnerability with a CVSS score of 5.5 (MEDIUM). MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply cra...
How severe is CVE-2026-85456?
CVE-2026-85456 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85456?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.