PT-2026-36879 · Unknown · Openc3 Cosmos

Ctrlsill · Published 2026-04-22 · Updated 2026-05-08 · CVE-2026-42085

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions prior to 6.10.5 OpenC3 COSMOS versions prior to 7.0.0-rc3

Description A design flaw in the save tool config() function allows users to save tool configuration files at arbitrary locations within the shared /plugins directory tree by providing crafted configuration filenames. While standard path traversal attacks are mitigated by canonicalizing filenames to absolute paths, the shared root directory for all plugins enables the creation of arbitrary file structures and the overwriting of existing configuration files within that directory.

Recommendations Update to version 6.10.5. Update to version 7.0.0-rc3.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-42085

GHSA-4JVX-93H3-F45H

Affected Products

Openc3 Cosmos

References · 14

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42085.yml · Exploit
• 🔥 https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h · Exploit
• https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5 · Patch
• https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42 · Patch
• https://osv.dev/vulnerability/GHSA-4jvx-93h3-f45h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42085 · Security Note
• https://github.com/OpenC3/cosmos · Note
• https://github.com/OpenC3/cosmos/releases/tag/v6.10.5 · Note
• https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 · Note
• https://twitter.com/CVEnew/status/2051361265986015589 · Twitter Post
• https://t.me/cveNotify/162783 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051393413417672742 · Twitter Post
• https://t.me/cveNotify/162545 · Telegram Post
• https://t.me/cveNotify/162069 · Telegram Post