CVE-2026-21878: BACnet Stack Path Traversal Vulnerability

CVE-2026-21878 Overview

A path traversal vulnerability has been discovered in BACnet Stack, an open source BACnet protocol stack C library designed for embedded systems. The vulnerability exists in the file writing functionality where user-provided file paths are not properly validated, allowing attackers to write files to arbitrary directories on the affected system. This affects the apps/readfile/main.c and ports/posix/bacfile-posix.c components of the library.

Critical Impact

Attackers can exploit this path traversal vulnerability to write arbitrary files to any directory accessible by the application, potentially leading to configuration tampering, code execution through file overwrites, or system compromise in embedded industrial control systems.

Affected Products

• BACnet Stack versions prior to 1.5.0.rc3
• BACnet Stack 1.5.0.rc1
• BACnet Stack 1.5.0.rc2

Discovery Timeline

• 2026-02-13 - CVE CVE-2026-21878 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-21878

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as a Path Traversal vulnerability. The flaw resides in the file handling routines within apps/readfile/main.c and ports/posix/bacfile-posix.c, where user-supplied file paths are accepted and processed without adequate validation or sanitization.

The lack of input validation allows an attacker to craft malicious file paths containing directory traversal sequences (such as ../) to escape the intended directory structure. When the application processes these paths, it writes files to locations outside the expected directory, potentially overwriting critical system files or placing malicious content in sensitive locations.

Given that BACnet Stack is commonly deployed in building automation systems, industrial control environments, and other embedded systems, exploitation of this vulnerability could have significant implications for operational technology (OT) security.

Root Cause

The root cause of this vulnerability is insufficient input validation in the file path handling code. The affected functions in apps/readfile/main.c and ports/posix/bacfile-posix.c fail to sanitize or canonicalize user-provided file paths before performing file write operations. This allows path traversal sequences to be interpreted literally by the underlying file system operations, enabling directory escape attacks.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send specially crafted BACnet file service requests containing malicious file paths to a vulnerable BACnet Stack implementation. The attack flow typically involves:

1. Identifying a system running a vulnerable version of BACnet Stack with file services enabled
2. Crafting a file write request with path traversal sequences in the filename parameter
3. Sending the malicious request to the target system
4. The vulnerable code processes the path without validation, writing the attacker-controlled content to an arbitrary location

The vulnerability mechanism involves insufficient path sanitization in the file writing handlers. Specifically, the affected code in apps/readfile/main.c and ports/posix/bacfile-posix.c does not properly validate or canonicalize incoming file paths before processing them. Attackers can inject directory traversal sequences (e.g., ../) to navigate outside the intended directory boundary. For detailed technical information on the fix, refer to the GitHub Security Advisory GHSA-p8rx-c26w-545j.

Detection Methods for CVE-2026-21878

Indicators of Compromise

• File system anomalies including unexpected files in system directories or configuration locations
• BACnet file service requests containing path traversal sequences such as ../ or ..\\
• Unusual file write operations targeting directories outside the BACnet application's normal working directory
• Modified configuration files or system binaries with timestamps correlating to BACnet network activity

Detection Strategies

• Monitor BACnet traffic for file service messages containing directory traversal patterns in file path parameters
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications
• Deploy network intrusion detection rules to identify malicious BACnet file service requests
• Enable verbose logging on BACnet Stack implementations to capture file operation details

Monitoring Recommendations

• Establish baseline BACnet file service activity and alert on deviations from normal patterns
• Monitor for file write operations outside expected application directories
• Implement real-time alerting for any BACnet file service requests containing ../ or encoded traversal sequences
• Review BACnet Stack application logs regularly for error messages related to file operations

How to Mitigate CVE-2026-21878

Immediate Actions Required

• Upgrade BACnet Stack to version 1.5.0.rc3 or later immediately
• If upgrade is not immediately possible, disable file services in BACnet Stack configurations
• Implement network segmentation to restrict BACnet protocol access to authorized systems only
• Apply principle of least privilege to the user account running BACnet Stack applications

Patch Information

The vulnerability has been fixed in BACnet Stack version 1.5.0.rc3. The fix implements proper path validation and sanitization to prevent directory traversal attacks. The patch can be reviewed at the GitHub Commit Changes. Organizations should update to the patched version as soon as possible.

Additional details are available in the GitHub Security Advisory GHSA-p8rx-c26w-545j.

Workarounds

• Disable BACnet file services if not required for operational purposes
• Implement network access controls to restrict BACnet communication to trusted hosts only
• Deploy application-level firewalls or proxies that can inspect and filter BACnet traffic for malicious patterns
• Run BACnet Stack applications in containerized or sandboxed environments with restricted file system access

# Network segmentation example using iptables to restrict BACnet access (UDP port 47808)
# Allow BACnet traffic only from trusted management network
iptables -A INPUT -p udp --dport 47808 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP

# Run BACnet application with restricted permissions
chroot /var/bacnet /usr/bin/bacnet-app --config /etc/bacnet.conf