CVE-2026-92748: BC Security Empire Path Traversal Flaw

CVE-2026-92748 Overview

BC Security Empire before version 6.7.1 contains a path traversal vulnerability [CWE-22] in its file upload endpoints. The framework fails to validate the multipart filename parameter, allowing authenticated operators to write files to arbitrary paths on the command-and-control (C2) server. Attackers can supply path traversal sequences in the filename to escape the intended directory and write malicious files to sensitive filesystem locations, resulting in remote code execution on the Empire C2 host.

Critical Impact
An authenticated operator can achieve remote code execution on the Empire C2 server by uploading files with crafted filenames that traverse outside the designated upload directory.

Affected Products

BC Security Empire versions prior to 6.7.1
Empire server download_service.py upload handlers
Empire API v2 download endpoints in download_api.py

Discovery Timeline

2026-09-16 - CVE-2026-92748 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
v6.7.1 - BC Security released patched version addressing the path traversal issue (see GitHub Release v6.7.1)

Technical Details for CVE-2026-92748

Vulnerability Analysis

Empire is an open-source post-exploitation and adversary emulation framework. The vulnerability resides in the server's file upload handling, where the multipart filename parameter supplied by an authenticated operator is used directly to construct the destination path on disk. Because the server never normalizes the filename or validates that the resolved path stays within the intended uploads directory, sequences such as ../ allow the attacker to break out of directory containment.

An attacker who controls the destination path can overwrite Python source files, cron jobs, systemd units, SSH authorized_keys, or Empire configuration files. Writing to any of these locations converts an authenticated file upload into arbitrary code execution under the privileges of the Empire server process. Because Empire C2 servers frequently run with elevated privileges to bind low ports and manage tooling, the impact typically extends to full host compromise.

Root Cause

The root cause is missing sanitization of the multipart filename field in the upload endpoints defined in empire/server/api/v2/download/download_api.py and the download logic in empire/server/core/download_service.py. The unsanitized filename is passed through path-joining logic that does not verify the resulting path remains inside the intended base directory. See GitHub Issue #824 and the VulnCheck Advisory: Path Traversal RCE.

Attack Vector

Exploitation requires operator-level authentication to the Empire API. The attacker sends a multipart HTTP upload request to a vulnerable download endpoint with a filename value containing traversal sequences (for example, ../../../../etc/cron.d/empire). The server writes the request body to the traversed path, and code execution follows when the target file is executed or loaded by the operating system.

The patch introduced a safe_filename helper and reorganized dependencies. Selected hunks from the fix commit c33a626:

python

 from typing import Annotated
 
-from fastapi import Depends, File, HTTPException, Query, UploadFile
+from fastapi import Depends, HTTPException, Query
 from starlette.responses import FileResponse
 
 from empire.server.api.api_router import APIRouter

python

 import math
 from typing import Annotated
 
-from fastapi import Depends
+from fastapi import Depends, File, HTTPException, UploadFile
 from sqlalchemy.orm import Session
 
 from empire.server.common.empire import MainMenu
 from empire.server.core.db.base import SessionLocal
+from empire.server.utils.file_util import safe_filename
 
 
 def get_db():

Source: GitHub Commit c33a626

Detection Methods for CVE-2026-92748

Indicators of Compromise

Multipart upload requests to Empire API endpoints containing ../, ..\\, or URL-encoded traversal sequences (%2e%2e%2f) in the filename field.
Unexpected files written outside the Empire downloads/ directory, particularly in /etc/, ~/.ssh/, or Python site-packages paths.
New or modified cron entries, systemd units, or authorized_keys files created by the user running the Empire server process.
Empire server versions reported as less than 6.7.1 in service banners or git metadata.

Detection Strategies

Inspect Empire server access logs for POST requests to download/upload endpoints and flag any filename value containing traversal characters.
Monitor filesystem write events by the Empire process using auditd, eBPF, or endpoint telemetry, and alert on writes outside the designated uploads directory.
Compare deployed Empire installations against the fixed version 6.7.1 and inventory any exposed C2 hosts.

Monitoring Recommendations

Enable file integrity monitoring on /etc/cron.d/, /etc/systemd/system/, and user .ssh directories on hosts that run Empire.
Ingest Empire application logs into a centralized SIEM and correlate upload activity with subsequent process executions spawned by the Empire user.
Track authenticated API sessions and alert on operators uploading files with abnormal filename patterns or extensions.

How to Mitigate CVE-2026-92748

Immediate Actions Required

Upgrade all Empire deployments to version 6.7.1 or later using the official GitHub Release v6.7.1.
Rotate all Empire operator credentials and API tokens, since exploitation requires authenticated access.
Audit the Empire host filesystem for files created or modified outside the expected uploads directory since the server was deployed.

Patch Information

The upstream fix is commit c33a626316cb20bc8ed707e03a22d324d5d4762a, which introduces a safe_filename utility and rewires the upload dependencies to validate multipart filenames before writing to disk. The fix is included in Empire 6.7.1. Review the GitHub Commit c33a626 and the VulnCheck Advisory: Path Traversal RCE for full technical details.

Workarounds

Restrict network access to the Empire API using firewall rules or a VPN so that only trusted operator workstations can reach the management port.
Run the Empire server as a low-privileged, dedicated user inside a container or chroot to limit the impact of arbitrary file writes.
Place a reverse proxy in front of the Empire API that rejects multipart requests whose filename field contains .., backslashes, or URL-encoded traversal sequences.

bash

# Upgrade to the patched release
git fetch --tags
git checkout v6.7.1
poetry install --sync

# Verify the safe_filename helper is present
grep -R "safe_filename" empire/server/utils/file_util.py