CVE-2026-32709

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-32709

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32709.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-32709

Aliases

GHSA-fh32-qxj9-x32f

Published

2026-03-13T21:19:33.528Z

Modified

2026-07-15T02:12:32.661118413Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)

Details

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem without authentication. On NuttX targets, the FTP root directory is an empty string, meaning attacker-supplied paths are passed directly to filesystem syscalls with no prefix or sanitization for read operations. On POSIX targets (Linux companion computers, SITL), the write-path validation function unconditionally returns true, providing no protection. A TOCTOU race condition in the write validation on NuttX further allows bypassing the only existing guard. This vulnerability is fixed in 1.17.0-rc2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32709.json",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/px4/px4-autopilot

Affected ranges

Type

GIT

Repo

https://github.com/px4/px4-autopilot

Events

Introduced

Fixed

d6f12ad1c4f70ad3230afd7d86e971421e02fef4

Introduced

c2fb48990aacebc938c4e9998c7d5348f858fd22

Last affected

61904bc14a9c34f5f87012410b5f473e074e55d8

Database specific

{
    "cpe": [
        "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.17.0"
        },
        {
            "introduced": "1.17.0-alpha1"
        },
        {
            "last_affected": "1.17.0-alpha1"
        },
        {
            "introduced": "1.17.0-beta1"
        },
        {
            "last_affected": "1.17.0-beta1"
        },
        {
            "introduced": "1.17.0-rc1"
        },
        {
            "last_affected": "1.17.0-rc1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*

1.17.0-alpha1

1.17.0-beta1

1.17.0-rc1

v1.*

v1.17.0-alpha1

v1.17.0-beta1

v1.17.0-rc1

v1.17.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32709.json"