Vulnerability Description
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/BC-SECURITY/Empire
- https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_se
- https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d
- https://github.com/BC-SECURITY/Empire/issues/824
- https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1
- https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traver
- https://github.com/BC-SECURITY/Empire/issues/824
FAQ
What is CVE-2026-92748?
CVE-2026-92748 is a vulnerability with a CVSS score of 8.8 (HIGH). BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers c...
How severe is CVE-2026-92748?
CVE-2026-92748 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92748?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.