CVE-2026-86147: CWE-73 External Control of File Name or Path in Apache Software Foundation Apache bRPC

CVE-2026-86147 describes two related vulnerabilities in Apache bRPC versions before 1.18.0. First, the builtin /flags service permits external control of file paths used for dumping profiling data due to insufficient validation, enabling attackers to create directories and overwrite files arbitrarily with server privileges. This is caused by the bvar_dump_file, bvar_dump_tabs, and mbvar_dump_file flags accepting any value without sanitization, including directory traversal sequences. Second, the /pprof service does not limit the profiling duration parameter (?seconds=), allowing attackers to hold the CPU and contention profilers for extended periods, effectively denying profiling services to others. Both vulnerabilities arise from improper input validation and lack of resource usage limits on builtin services exposed by default on the RPC port.

Successful exploitation allows remote attackers to create or overwrite files and directories on the server with the privileges of the Apache bRPC process, potentially leading to data corruption or unauthorized file manipulation. Additionally, attackers can cause denial of service by monopolizing profiling resources via the /pprof service, making profiling endpoints unavailable to legitimate users for extended durations.

A fix is available by upgrading Apache bRPC to version 1.18.0, which disables runtime modification of the vulnerable dump path flags via the /flags service and enforces a maximum profiling duration for /pprof requests. Alternatively, the patch at https://github.com/apache/brpc/pull/3523 can be applied. After the fix, dump path flags can only be changed programmatically and profiling duration is capped by the -max_profiling_seconds flag (default 300 seconds). Users should upgrade or patch affected systems promptly to mitigate these vulnerabilities.