CVE-2026-92604: Scirius Path Traversal Vulnerability

CVE-2026-92604 Overview

CVE-2026-92604 is an arbitrary file write vulnerability in Stamus Networks Scirius through version 3.8.0. The flaw resides in the PCAP filestore upload endpoint of the REST API. Authenticated users holding only the default User role can supply path traversal sequences inside the uploaded document's _id field. The application then writes attacker-controlled JSON content to filesystem paths outside the intended directory. Because the Scirius process runs as root, an attacker can write .json files to arbitrary locations on the host. The issue is categorized as a path traversal weakness [CWE-22] and affects integrity and availability of the underlying system.

Critical Impact
Low-privileged authenticated users can write attacker-controlled JSON files anywhere on the filesystem as root, enabling configuration tampering and potential code execution paths.

Affected Products

Stamus Networks Scirius through 3.8.0
Scirius suricata/rest_api.py PCAP filestore upload endpoint
Deployments exposing the Scirius REST API to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92604 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92604

Vulnerability Analysis

Scirius exposes a REST API endpoint that accepts PCAP filestore uploads. The handler in suricata/rest_api.py takes the _id field from the uploaded JSON document and uses it to construct the destination filename on disk. The value is concatenated into a filesystem path without normalization or validation against the intended storage directory. An attacker submitting an _id containing ../ sequences escapes the filestore directory and writes the document body to an arbitrary location. The written file receives a .json extension, and the write occurs with the privileges of the Scirius service process, which runs as root in default deployments.

Root Cause

The root cause is missing input sanitization on a user-controlled identifier used as a filesystem path component. The endpoint trusts the client-supplied _id value, does not enforce a whitelist of allowed characters, and does not verify that the resolved path remains inside the filestore base directory. Combined with excessive service privileges, this trust boundary failure escalates a low-privileged API action into a root-level file write.

Attack Vector

An attacker requires only network access to the Scirius REST API and credentials for a default User role account. The attacker issues an HTTP request to the PCAP filestore upload endpoint containing a JSON payload whose _id field embeds ../ traversal sequences pointing at a target directory. The server writes the JSON body to the resolved path. Practical abuse targets include cron directories, systemd unit paths, or application configuration files that accept or parse JSON. See the VulnCheck Advisory for Scirius and the Scirius REST API Code Review for the vulnerable code path.

Detection Methods for CVE-2026-92604

Indicators of Compromise

Unexpected .json files appearing outside the Scirius PCAP filestore directory, particularly under system paths owned by root.
HTTP requests to the PCAP filestore upload endpoint containing _id values with ../ or URL-encoded traversal sequences such as %2e%2e%2f.
Scirius process (root) creating files in directories unrelated to its normal filestore operations.

Detection Strategies

Inspect REST API access logs for POST requests to the PCAP filestore upload endpoint and flag payloads whose _id field contains path separators or traversal tokens.
Deploy filesystem integrity monitoring on directories the Scirius service should never write to, alerting on new .json files.
Correlate authenticated User role sessions with unusual filesystem write activity by the Scirius process using host telemetry.

Monitoring Recommendations

Enable audit logging (auditd or equivalent) on directories such as /etc, /root, /var/spool/cron, and systemd unit paths.
Forward Scirius application logs and host audit events to a centralized analytics platform for correlation across identity and filesystem events.
Baseline the normal filestore write path for Scirius and alert on any deviation.

How to Mitigate CVE-2026-92604

Immediate Actions Required

Restrict network access to the Scirius REST API to trusted management networks and administrators only.
Audit existing Scirius user accounts and remove or downgrade any unnecessary User role accounts.
Review the filesystem for unexpected .json files created by the Scirius process since deployment.

Patch Information

At the time of publication, the Stamus Networks Scirius Repository should be monitored for a fixed release beyond 3.8.0. Administrators should track the VulnCheck Advisory for Scirius and the OSS Documentation for Scirius for remediation guidance and upgrade instructions.

Workarounds

Place the Scirius REST API behind a reverse proxy that rejects requests containing traversal sequences in JSON _id fields.
Run the Scirius service under a dedicated non-root account with write access limited to the filestore directory.
Disable or block the PCAP filestore upload endpoint at the proxy layer until a fixed version is deployed.

bash

# Configuration example: nginx rule to block traversal patterns in PCAP upload requests
location /rest/suricata/hostfile/ {
    if ($request_body ~* "\"_id\"\s*:\s*\"[^\"]*(\.\./|%2e%2e)") {
        return 403;
    }
    proxy_pass http://scirius_backend;
}