PT-2026-22067 · Netexec · Netexec

Raynlight · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-27884

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NetExec versions prior to 1.5.1

Description NetExec is a network execution tool. The spider plus module does not properly handle file paths when saving files from SMB shares, specifically failing to account for path traversal characters like ../ in Linux SMB shares. This allows an attacker to craft a filename containing these characters, potentially leading to arbitrary file overwrites or creation during file downloads performed by the spider plus module. The issue is addressed in version 1.5.1.

Recommendations Versions prior to 1.5.1 should be updated to version 1.5.1 or later. As a workaround, avoid running spider plus with DOWNLOAD=true against targets.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-27884

GHSA-FCCR-6QM2-7H27

Affected Products

Netexec

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27884.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27884 · Security Note
• https://github.com/Pennyw0rth/NetExec/security/advisories/GHSA-fccr-6qm2-7h27 · Note
• https://github.com/Pennyw0rth/NetExec/issues/1120 · Note
• https://github.com/Pennyw0rth/NetExec/commit/7d027f2774d0520b322d60f9c99b9ab3edb4035e · Note
• https://github.com/Pennyw0rth/NetExec/pull/1121 · Note
• https://twitter.com/CVEnew/status/2027004240439263405 · Twitter Post