Most recent entries from all

EUVD-2026-198719

fkie_cve-2024-46977

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.

GHSA-8jxr-mccc-mwg8 — OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

Affected: RubyGems: openc3, PyPI: openc3

### Summary A path traversal vulnerability inside of `LocalMode`'s `open_local_file` method allows an authenticated user with adequate permissions to download any `.txt` via the `ScreensController#show` on the web server COSMOS is running on (depending on the file permissions).

Note: This CVE affects all OpenC3 COSMOS Editions

### Impact This issue may lead to Information Disclosure.

PYSEC-2024-101

Affected: PyPI: openc3