Path Traversal in BC Security Empire Upload Endpoint

BC Security Empire versions before 6.7.1 contain a critical vulnerability in the handling of multipart filename parameters within the application's upload endpoints. This flaw allows an authenticated operator to perform path traversal attacks by injecting directory traversal sequences into the filename field during a file upload request. By successfully bypassing directory containment, an attacker can write arbitrary files to restricted locations on the underlying C2 server. This vulnerability is particularly severe because it provides a mechanism for an authenticated user to escalate privileges or achieve remote code execution by overwriting configuration files, web roots, or startup scripts on the server. Defenders should identify any anomalous file creation activity originating from authorized C2 operators and prioritize upgrading to version 6.7.1 or later to mitigate this risk.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary file write capabilities on the C2 server. By writing to sensitive paths, an attacker can gain remote code execution, persist across system reboots, or modify server configuration to weaken security controls. Given that Empire is a Command and Control (C2) framework, compromising the server integrity undermines the security of the entire infrastructure managed by that server.

Recommendation

• Upgrade all BC Security Empire instances to version 6.7.1 or later immediately to patch CVE-2026-92748.
• Audit logs for the upload endpoints to identify requests containing directory traversal patterns such as "../" or "..\" in multipart filename fields.
• Review file system integrity on the C2 server for unexpected file modifications in system-critical or configuration directories.