CVE-2026-85199: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Eclipse Foundation Eclipse aeriOS
Description
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process. The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration. The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.
CVSS v4.0
Score 8.8high
Affected software
Eclipse Foundation
Eclipse aeriOS
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85199 is a path traversal vulnerability (CWE-22) in Eclipse Foundation's Eclipse aeriOS Self-orchestrator REST API versions before 1.2.1. User-supplied identifiers used in resource management are incorporated into filesystem paths without proper validation or sanitization, enabling unauthenticated remote attackers to craft identifiers with path traversal sequences. This can lead to unauthorized writing or deletion of JSON files outside the intended directories, constrained only by the filesystem permissions of the Self-orchestrator process. The vulnerability is exacerbated by the API's lack of authentication and the container running with elevated privileges. The vulnerability was addressed in version 1.2.1 by adding validation and sanitization to prevent path separator characters from escaping intended directories.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to write or delete files outside the intended application directories, potentially impacting system integrity and availability. The lack of authentication on the affected API and elevated container privileges increase the severity and potential impact of exploitation.
Mitigation Recommendations
A fix is available in Eclipse aeriOS version 1.2.1, which introduces validation and sanitization of user-controlled identifiers to prevent path traversal. Users should upgrade to version 1.2.1 or later to remediate this vulnerability. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-03T12:53:45.744Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9982b8acd9273b4909fd77
Added to database: 09/03/2026, 14:22:48 UTC
Last enriched: 09/07/2026, 13:10:17 UTC
Last updated: 10/16/2026, 18:48:25 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.