PT-2026-25394 · Px4+2 · Px4-Autopilot+1

Dxleryt · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32709

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.17.0-rc2

Description PX4 autopilot is a flight control solution for drones. A path traversal issue exists in the PX4 Autopilot MAVLink FTP implementation that allows any MAVLink peer to perform unauthorized file operations – including reading, writing, creating, deleting, and renaming – on the flight controller filesystem without authentication. On NuttX systems, the FTP root directory is empty, leading to direct passing of attacker-supplied paths to filesystem calls without any sanitization during read operations. On POSIX systems, the write-path validation function does not provide any protection. A time-of-check to time-of-use (TOCTOU) race condition in the write validation on NuttX systems further bypasses existing security measures.

Recommendations Versions prior to 1.17.0-rc2 should be updated to version 1.17.0-rc2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32709

GHSA-FH32-QXJ9-X32F

Affected Products

Px4-Autopilot

Px4 Drone Autopilot

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32709.json · Exploit
• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-fh32-qxj9-x32f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32709 · Security Note
• https://t.me/CVEtracker/47388 · Telegram Post