CVE-2026-27884: NetExec Path Traversal Vulnerability

CVE-2026-27884 Overview

CVE-2026-27884 is a Path Traversal vulnerability affecting NetExec, a network execution tool. Prior to version 1.5.1, the spider_plus module improperly creates the output file and folder path when saving files from SMB shares. The module does not account for the possibility that Linux SMB shares can contain path traversal characters such as ../ in filenames. An attacker can craft a malicious filename in an SMB share that includes these traversal sequences, which when crawled and downloaded by spider_plus, can write or overwrite arbitrary files on the system running NetExec.

Critical Impact

Attackers can achieve arbitrary file write or overwrite capabilities by exploiting improper path validation in the spider_plus module, potentially leading to system compromise or denial of service.

Affected Products

• NetExec versions prior to 1.5.1
• Systems running spider_plus module with DOWNLOAD=true against untrusted targets
• Linux environments using SMB share crawling functionality

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27884 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27884

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'). The spider_plus module in NetExec is designed to crawl SMB shares and optionally download discovered files. When processing filenames from remote SMB shares, the module constructs local file paths by directly concatenating the remote path components without proper sanitization.

On Linux systems, SMB shares can legitimately contain directory separators and path traversal sequences like ../ within filenames. The vulnerable code failed to validate or sanitize these sequences before constructing the local output path, allowing an attacker-controlled filename to escape the intended output directory.

Root Cause

The root cause lies in the file path construction logic within nxc/modules/spider_plus.py. The original implementation used os.path.join() and related path manipulation functions without considering that SMB share paths could contain path traversal characters. The module trusted the remote filename input without sanitizing directory traversal sequences, violating the principle of input validation for untrusted data.

Attack Vector

The attack requires network access and user interaction. An attacker must control or compromise an SMB share that the target NetExec user will crawl. By placing a file with a crafted filename containing path traversal sequences (e.g., ../../../etc/cron.d/malicious_job) on the SMB share, the attacker can cause the spider_plus module to write files to arbitrary locations on the victim's filesystem when run with DOWNLOAD=true.

 import json
 import errno
-from os.path import abspath, join, split, exists, splitext, getsize, sep
+from os.path import abspath, join, exists, splitext, getsize
 from os import makedirs, remove, stat
+from pathlib import Path, PurePosixPath
 import time
 from nxc.helpers.misc import CATEGORY
 from nxc.paths import NXC_PATH

Source: GitHub Commit Details

The patch introduces pathlib.Path and PurePosixPath for safer path handling, removing the vulnerable split and sep imports that were part of the insecure path construction logic.

Detection Methods for CVE-2026-27884

Indicators of Compromise

• Unexpected files appearing outside of NetExec's designated output directories
• Files in sensitive system directories (e.g., /etc/cron.d/, /home/*/.ssh/) with recent modification times correlating with spider_plus execution
• SMB share filenames containing ../ sequences in network logs or packet captures

Detection Strategies

• Monitor file creation events in system directories that should not receive files from user tools
• Implement file integrity monitoring (FIM) on critical system paths to detect unauthorized writes
• Audit NetExec command invocations for spider_plus module usage with DOWNLOAD=true flag

Monitoring Recommendations

• Review SMB traffic logs for suspicious filenames containing path traversal patterns
• Configure endpoint detection to alert on file writes to sensitive directories from NetExec processes
• Maintain an inventory of NetExec versions deployed and flag installations running versions prior to 1.5.1

How to Mitigate CVE-2026-27884

Immediate Actions Required

• Upgrade NetExec to version 1.5.1 or later immediately
• Audit recent spider_plus executions with DOWNLOAD=true for potential compromise
• Review file system for unexpected files that may have been written through exploitation

Patch Information

The vulnerability is patched in NetExec version 1.5.1. The fix introduces proper path sanitization using Python's pathlib module to prevent path traversal sequences from escaping the intended output directory. For detailed patch information, see the GitHub Security Advisory and the GitHub Pull Request Review.

Workarounds

• Do not run spider_plus with DOWNLOAD=true against untrusted or potentially compromised SMB targets
• Only use the module for enumeration without file download functionality until patched
• If downloading is required, use the module only against fully trusted internal shares

# Configuration example
# Avoid using DOWNLOAD=true flag until upgraded to v1.5.1
# Vulnerable usage (avoid):
# netexec smb target -u user -p pass -M spider_plus -o DOWNLOAD=true

# Safer enumeration-only usage:
netexec smb target -u user -p pass -M spider_plus