CVE-2026-8662

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8662", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2026-05-15T06:29:05.299Z", "datePublished": "2026-06-25T01:51:33.568Z", "dateUpdated": "2026-06-25T13:33:17.489Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-06-25T01:51:33.568Z"}, "title": "Path Traversal in Rapid7 InsightConnect Compression Plugin", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Arbitrary File Overwrite (with garbage data)"}]}], "affected": [{"vendor": "Rapid7", "product": "InsightConnect Compression Plugin", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.3", "versionType": "custom"}, {"status": "unaffected", "version": "2.0.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker."}]}], "references": [{"url": "https://extensions.rapid7.com/extension/compression", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"}}], "credits": [{"lang": "en", "value": "Jacob Steadman, Rapid7", "type": "finder"}, {"lang": "en", "value": "Jed Starr, Rapid7", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T13:30:42.837070Z", "id": "CVE-2026-8662", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T13:33:17.489Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8662", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:30:42.837070Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T13:31:16.681Z"}}], "cna": {"title": "Path Traversal in Rapid7 InsightConnect Compression Plugin", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jacob Steadman, Rapid7"}, {"lang": "en", "type": "finder", "value": "Jed Starr, Rapid7"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Arbitrary File Overwrite (with garbage data)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rapid7", "product": "InsightConnect Compression Plugin", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.3", "versionType": "custom"}, {"status": "unaffected", "version": "2.0.3", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://extensions.rapid7.com/extension/compression", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.", "supportingMedia": [{"type": "text/html", "value": "Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-06-25T01:51:33.568Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8662", "state": "PUBLISHED", "dateUpdated": "2026-06-25T13:33:17.489Z", "dateReserved": "2026-05-15T06:29:05.299Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2026-06-25T01:51:33.568Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "InsightConnect Compression Plugin", "vendor": "Rapid7", "versions": [{"lessThan": "2.0.3", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2.0.3", "versionType": "custom"}]}], "source": "cve@rapid7.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:insightconnect_compression:*:*:*:*:*:rapid7:*:*", "matchCriteriaId": "0A39360B-E5CF-452A-AF79-CB2260CCDA1A", "versionEndExcluding": "2.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker."}, {"lang": "es", "value": "Vulnerabilidad de salto de ruta en la funci\u00f3n create_archive del Plugin de Compresi\u00f3n Rapid7 InsightConnect en Linux permite a atacantes autenticados escribir en rutas de archivo no deseadas mediante una entrada de nombre de archivo manipulada. El impacto se limita a la corrupci\u00f3n de archivos, ya que el contenido no puede ser controlado por el atacante."}], "id": "CVE-2026-8662", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 2.5, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8662", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T13:30:42.837070Z", "version": "2.0.3"}}]}, "published": "2026-06-25T03:16:44.113", "references": [{"source": "cve@rapid7.com", "tags": ["Product"], "url": "https://extensions.rapid7.com/extension/compression"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.3)"}}, {"platform": ["linux"], "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "InsightConnect Compression Plugin", "source": "cna", "vendor": "Rapid7"}, "product": "insightconnect_compression_plugin", "vendor": "rapid7"}], "created": "2026-06-25T03:30:17.863802+00:00", "updated": "2026-06-26T09:38:34.194407+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$insightconnect_compression_plugin"]}