Arbitrary File Write in Scirius PCAP Filestore Upload

hello@craftedsignal.io — Wed, 16 Sep 2026 19:51:59 +0000

Scirius versions through 3.8.0 contain a critical vulnerability in the PCAP filestore upload endpoint that permits arbitrary file writes. The flaw originates from insufficient sanitization of the _id field within uploaded JSON documents processed by the endpoint. Authenticated users assigned the default User role can exploit this by injecting path traversal sequences (such as ../) into the _id field. This manipulation allows the application to write attacker-controlled JSON content to arbitrary locations on the host filesystem. Because the application processes these requests with root privileges, this vulnerability enables the creation of malicious files with a .json extension in protected directories, potentially facilitating further exploitation such as configuration manipulation or code execution.

Impact

Successful exploitation allows authenticated low-privileged users to achieve arbitrary file writes with root privileges. This can lead to full system compromise, persistent unauthorized access, or the overwriting of critical system configuration files.

Recommendation

Upgrade Scirius to a patched version beyond 3.8.0 as soon as the vendor makes a fix available.
Audit logs for the PCAP filestore upload endpoint for requests containing path traversal characters (e.g., ../) in the _id field.
Restrict access to the PCAP filestore upload functionality to only authorized administrative accounts.

Scirius (<= 3.8.0) - CraftedSignal Threat Feed

Arbitrary File Write in Scirius PCAP Filestore Upload

Impact

Recommendation