CVE-2026-78299 is a CWE-22 path traversal vulnerability affecting Eclipse Embedded CDT (C/C++ Development Tools) versions 6.0.0 up to but not including 6.8.0. The flaw occurs during the extraction of CMSIS-Pack archives, where a maliciously crafted pack can cause files to be extracted outside the designated directory. This improper limitation of pathname allows an attacker to write arbitrary files to arbitrary locations on the filesystem.

Successful exploitation can lead to arbitrary file writes outside the intended directory, which may allow an attacker to overwrite critical files or place malicious files on the system. This could potentially lead to further compromise depending on the environment and file permissions. No known exploits are reported in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting CMSIS-Pack archives from untrusted sources or use additional controls to validate pack contents before extraction.