Path traversal in LinuxCNC
Priority LOW 38CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed LinuxCNC (LinuxCNC): 2.9.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA LinuxCNC (LinuxCNC) Fixed in 2.9.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-58302
- 2026-10-03 Alias added: GHSA-h3vh-9phr-5gjm
References
Sources
- CVE-2026-58302 · CVE Program
- CVE-2026-58302 · NVD
- FIRST EPSS
- GHSA-h3vh-9phr-5gjm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences