CVE-2026-78299

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-78299

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78299.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-78299

Aliases

GHSA-qch4-8rmp-mjx3

Published

2026-09-14T12:59:14Z

Modified

2026-09-16T03:47:23Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

Database specific

{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78299.json"
}

References

Affected packages

Git / github.com/eclipse-embed-cdt/eclipse-plugins

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-embed-cdt/eclipse-plugins

Events

Introduced

d1356bd492887ee169c84061cfbfd9be9e773ee1

Fixed

0f6f231872f6c6af65cad7a05146684dfa0a8f15

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.8.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v6.*

v6.0.0

v6.1.0

v6.1.0-202101060807

v6.1.0-202101081915

v6.1.1

v6.1.2

v6.1.2-202102181132

v6.2.1

v6.2.1-202204041943

v6.2.2

v6.2.2-202206121057

v6.3.0

v6.3.0-202208180721

v6.3.1

v6.3.1-202210101738

v6.3.2

v6.3.2-202304281106

v6.4.0

v6.4.0-202307251916

v6.5.0

v6.6.0

v6.6.0-202404031712

v6.6.1

v6.6.1-202408270735

v6.7.0

v6.7.0-202602251544

v6.8.0-202608251538

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78299.json"