CVE-2026-78299 Overview
CVE-2026-78299 is a path traversal vulnerability [CWE-22] affecting Eclipse Embedded CDT versions 6.0 through 6.7. The flaw resides in the CMSIS-Pack archive extraction routine. When the plugin extracts a compromised CMSIS pack, the extraction logic fails to validate destination paths. An attacker can craft an archive containing entries with traversal sequences that resolve outside the pack directory. Successful exploitation writes arbitrary files to any location the Eclipse process can access on disk. This enables code execution through overwriting startup scripts, configuration files, or binaries used by the developer workstation.
Critical Impact
A malicious CMSIS pack can write arbitrary files anywhere on the developer's disk, enabling persistence and code execution on embedded development workstations.
Affected Products
- Eclipse Embedded CDT 6.0
- Eclipse Embedded CDT versions 6.1 through 6.6
- Eclipse Embedded CDT 6.7
Discovery Timeline
- 2026-09-14 - CVE-2026-78299 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-78299
Vulnerability Analysis
Eclipse Embedded CDT provides tooling for ARM and RISC-V embedded development inside the Eclipse IDE. The plugin consumes CMSIS-Pack archives, which are ZIP-formatted bundles containing device support files, headers, and libraries. The extraction routine iterates through archive entries and writes each entry to a target directory beneath the workspace pack cache. The routine does not canonicalize entry names or verify that resolved paths remain within the intended output directory. An entry named with parent-directory sequences such as ../../../ escapes the extraction root during file write operations. The affected code path executes whenever a user installs or updates a pack from any configured source.
Root Cause
The underlying defect is a classic Zip Slip pattern. The extraction logic concatenates the pack destination path with the raw entry name from the archive without sanitization. Java File and FileOutputStream constructors resolve traversal sequences during write, allowing writes outside the pack root. The extractor does not compare the canonical output path against the canonical destination directory before opening the output stream.
Attack Vector
An attacker hosts or distributes a modified CMSIS pack containing entries with path traversal sequences in their filenames. A developer installs the pack through the Eclipse Embedded CDT pack manager, either from a compromised repository, a supply-chain intermediary, or a spoofed vendor URL. The extraction process writes attacker-controlled files to locations such as user startup directories, SSH configuration files, or the Eclipse dropins folder. No authentication or elevated privilege is required beyond the developer initiating a pack install. Technical details are documented in the GitHub Security Advisory GHSA-qch4-8rmp-mjx3 and the GitLab Vulnerability Report #747.
Detection Methods for CVE-2026-78299
Indicators of Compromise
- Files written outside the Eclipse workspace .packs or CMSIS pack cache directory during or immediately after a pack installation.
- CMSIS pack archives containing entries whose names include ../ or absolute path prefixes when inspected with archive tools.
- Unexpected modifications to user profile scripts, SSH configuration, or Eclipse dropins directories following pack manager activity.
Detection Strategies
- Inspect .pack files with a ZIP listing utility before installation and flag any entry containing .. sequences or absolute paths.
- Monitor file system activity by the Eclipse Java process during pack installs and alert on writes outside the configured pack cache root.
- Compare cryptographic hashes of downloaded packs against publisher-provided signatures where available.
Monitoring Recommendations
- Enable audit logging on developer workstations for writes to sensitive directories such as ~/.ssh, ~/.bashrc, Windows Startup folders, and Eclipse installation directories.
- Ingest endpoint file-write telemetry into a centralized detection platform and correlate with Eclipse process activity.
- Alert on pack installations sourced from non-approved repositories or unsigned publishers.
How to Mitigate CVE-2026-78299
Immediate Actions Required
- Stop installing or updating CMSIS packs from untrusted or unverified sources until upgrading to a fixed release.
- Upgrade Eclipse Embedded CDT beyond version 6.7 once a patched release is available per the vendor advisory.
- Audit developer workstations that recently installed CMSIS packs for unexpected files in system and user directories.
Patch Information
Refer to the Eclipse Embedded CDT security advisory GHSA-qch4-8rmp-mjx3 for the corrected release version and update instructions. Users should update the plugin through the Eclipse Marketplace or the project update site once the fixed version is published.
Workarounds
- Restrict CMSIS pack sources in the plugin configuration to trusted vendor URLs only.
- Manually inspect archive contents with unzip -l or an equivalent utility before installation and reject packs containing traversal sequences.
- Run Eclipse under a least-privilege user account that cannot write to system directories or other users' home directories.
# Inspect a CMSIS pack for path traversal entries before installation
unzip -l suspicious.pack | grep -E '\.\./|^/'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
