Read the docs
TI-2026-30453 Aliases CVE-2026-42085GHSA-4jvx-93h3-f45h

OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

Priority LOW 20CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cosmos (OpenC3): 6.10.5, 7.0.0-rc3openc3 (RubyGems): 6.10.5, 7.0.0-rc3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenC3cosmosbefore 6.10.5; 7.0.0.pre.rc1 to before 7.0.0-rc36.10.5, 7.0.0-rc3Patch availableCNA
—openc3 (RubyGems)before 6.10.56.10.5Patch availableGHSA-4jvx-93h3-f45h
—openc3 (RubyGems)7.0.0.pre.rc1 to before 7.0.0-rc37.0.0-rc3Patch availableGHSA-4jvx-93h3-f45h
  • cosmos VendorOpenC3 Affected before 6.10.5; 7.0.0.pre.rc1 to before 7.0.0-rc3 Fixed in 6.10.5, 7.0.0-rc3 Patch available CNA
  • openc3 (RubyGems) Vendor— Affected before 6.10.5 Fixed in 6.10.5 Patch available GHSA-4jvx-93h3-f45h
  • openc3 (RubyGems) Vendor— Affected 7.0.0.pre.rc1 to before 7.0.0-rc3 Fixed in 7.0.0-rc3 Patch available GHSA-4jvx-93h3-f45h

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*before 6.10.5VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*7.0.0 rc1VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*7.0.0 rc2VulnerableOpenC3
  • cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:* Versions before 6.10.5 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:* Versions 7.0.0 rc1 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:* Versions 7.0.0 rc2 Vulnerable ·OpenC3

Remediation

  • Fix · CNA cosmos (OpenC3) Fixed in 6.10.5, 7.0.0-rc3
  • Fix · GHSA-4jvx-93h3-f45h openc3 (RubyGems) Fixed in 6.10.5 Advisory →
  • Fix · GHSA-4jvx-93h3-f45h openc3 (RubyGems) Fixed in 7.0.0-rc3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42085
  2. 2026-10-03 Alias added: GHSA-4jvx-93h3-f45h

References

Exploit 1

Patch 2

Advisory 1

Other 4

  • TI-2025-20781 Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. CVSS 3.1CRITICAL 9.8
  • TI-2025-20780 OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. CVSS 3.1CRITICAL 9.8
  • TI-2025-20779 A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3… CVSS 3.1CRITICAL 9.8
  • TI-2025-20778 An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows… CVSS 3.1CRITICAL 9.1
  • TI-2026-30456 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool CVSS 3.1CRITICAL 9.6
  • TI-2026-30455 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CVSS 3.1CRITICAL 9.6
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences