CVE-2026-79653

MediumCVSS 6.0

Published: 27/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Vulnerability in Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0 allows an attacker to manipulate the filename upon upload, enabling arbitrary file path traversal when file system storage is used.

Risk Assessment

An attacker can write files to arbitrary locations on the server, potentially leading to overwriting critical files or unauthorized access.

Recommendation

Disable enable.attachment.store.to.file.system or update SW360 to a patched version.

Original NVD description (English source)

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.