Scirius versions up to 3.8.0 contain an arbitrary file write vulnerability in the PCAP filestore upload endpoint. The flaw allows authenticated users with default User role permissions to supply path traversal sequences in the _id field of uploaded JSON documents. This bypasses directory restrictions and enables writing files with a .json extension to arbitrary filesystem locations with root privileges. The vulnerability is identified as CVE-2026-92604 and has a CVSS 4.0 base score of 7.2, indicating high severity.

An attacker with default User role access can write arbitrary JSON files anywhere on the filesystem as root. This could lead to unauthorized file creation or modification, potentially enabling privilege escalation, persistence, or disruption of system operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PCAP filestore upload endpoint to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary User role privileges to untrusted users.