CVE-2026-8662 Overview
CVE-2026-8662 is a path traversal vulnerability [CWE-22] in the create_archive function of the Rapid7 InsightConnect Compression Plugin on Linux. Authenticated attackers can supply crafted filename input to write files outside the intended archive directory. The impact is constrained to file corruption because the attacker cannot control the content written to the target path. Exploitation requires high privileges and high attack complexity, limiting practical risk.
Critical Impact
Authenticated attackers with high privileges can corrupt files at unintended paths by abusing crafted filename input to the create_archive function.
Affected Products
- Rapid7 InsightConnect Compression Plugin (Linux)
- See the Rapid7 Extension Overview for plugin details
Discovery Timeline
- 2026-06-25 - CVE-2026-8662 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-8662
Vulnerability Analysis
The vulnerability resides in the create_archive function of the Rapid7 InsightConnect Compression Plugin. The function accepts a filename parameter without normalizing or validating path separators. Attackers can include traversal sequences such as ../ in the filename to redirect archive creation to arbitrary file system locations. Because the plugin runs in the InsightConnect orchestration context on Linux, traversal can target paths outside the plugin's intended working directory.
The impact is limited to file corruption. The attacker cannot dictate the content written to the destination because the plugin generates archive output based on its own logic. Overwriting critical files such as configuration or service binaries can still disrupt application availability or integrity.
Root Cause
The root cause is missing input sanitization on the filename parameter passed to create_archive. The function does not enforce a canonical path within an allowed base directory, so user-supplied traversal sequences pass through to file write operations. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw.
Attack Vector
An authenticated user with permissions to invoke the Compression Plugin submits a workflow action containing a filename such as ../../etc/target_file. When create_archive processes the input, it writes archive output to the traversed path. Network reachability is required to call the plugin, and the actor must already hold high privileges within InsightConnect, which raises the practical exploitation bar.
No verified exploit code is publicly available for this issue. Refer to the Rapid7 Extension Overview for plugin behavior.
Detection Methods for CVE-2026-8662
Indicators of Compromise
- Unexpected file modifications or zero-byte file corruption at paths outside the Compression Plugin's working directory.
- InsightConnect workflow execution logs containing filename parameters with ../ or absolute path sequences.
- Failed service starts or configuration parse errors immediately following Compression Plugin job execution.
Detection Strategies
- Inspect InsightConnect audit logs for create_archive invocations and flag filename arguments containing path separators or traversal tokens.
- Monitor file integrity on directories adjacent to the plugin's runtime path to identify unauthorized writes.
- Correlate plugin execution events with authenticated user identity to identify abnormal high-privilege workflow modifications.
Monitoring Recommendations
- Enable verbose logging on InsightConnect plugin executions and forward logs to a centralized analytics platform.
- Alert on archive operations targeting filenames with .., leading /, or null-byte sequences.
- Track plugin configuration changes and workflow edits performed by privileged accounts.
How to Mitigate CVE-2026-8662
Immediate Actions Required
- Update the Rapid7 InsightConnect Compression Plugin to the latest version published on the Rapid7 Extensions portal.
- Restrict workflow editing and plugin invocation privileges to a minimum set of trusted operators.
- Audit existing workflows that call create_archive for suspicious filename inputs.
Patch Information
Apply the latest Compression Plugin release distributed through the Rapid7 Extensions portal. Consult the Rapid7 Extension Overview for the current version and release notes.
Workarounds
- Disable or remove the Compression Plugin from InsightConnect environments where archive creation is not required.
- Enforce role-based access controls so only vetted accounts can modify or execute workflows using this plugin.
- Validate filename parameters in upstream workflow steps to reject path separators before they reach create_archive.
# Example: review InsightConnect workflow definitions for risky filename inputs
grep -RniE '"filename"\s*:\s*".*(\.\./|^/).*"' /path/to/insightconnect/workflows/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
