CVE-2026-85456

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-854578.1IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overfl CVE-2026-854582.1Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.CVE-2026-85465.3Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the rend CVE-2026-854698.0A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` u CVE-2026-85477.5Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromis CVE-2026-854716.4A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to CVE-2026-854735.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range val CVE-2026-854757.2A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by inte CVE-2026-854768.2Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: CVE-2026-854783.5A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface wit CVE-2026-854795.3The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated CVE-2026-85488.3Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to