CVE-2026-85456

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85456

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85456.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85456

Published

2026-09-03T22:38:42Z

Modified

2026-09-06T08:03:30Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows

Details

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85456.json"
}

References

Affected packages

Git / github.com/moos-ivp/moos-ivp

Affected ranges

Type

GIT

Repo

https://github.com/moos-ivp/moos-ivp

Events

Introduced

Fixed

477be7e91bf220185d55e5a2a9dba16dbde32c3f

Fixed

6f0619e905b325d6b88f76425673045c6e4f6f94

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.8.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85456.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "205105793825430045765894660149070176882",
            "length": 721
        },
        "id": "CVE-2026-85456-17eb9c04",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moos-ivp/moos-ivp/commit/477be7e91bf220185d55e5a2a9dba16dbde32c3f",
        "target": {
            "file": "ivp/src/lib_mbutil/ReleaseInfo.cpp",
            "function": "showReleaseInfo"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71475089026327374911439190140854268963",
                "288109013441206453595364179806630758895",
                "108583411300907172617501463823770114997",
                "17171581118612079636848717634386598063"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85456-703d642b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moos-ivp/moos-ivp/commit/477be7e91bf220185d55e5a2a9dba16dbde32c3f",
        "target": {
            "file": "ivp/src/pMarineViewer/main.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "118965062358282729215132681048895208743",
            "length": 2942
        },
        "id": "CVE-2026-85456-9c0df7cc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moos-ivp/moos-ivp/commit/477be7e91bf220185d55e5a2a9dba16dbde32c3f",
        "target": {
            "file": "ivp/src/pMarineViewer/main.cpp",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "221566291563585211413467636629101977597",
                "69881209764151303531923320257498233409",
                "153719805825789704065453832941046288979",
                "196362707078072643545117675400601289962"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85456-b57c450a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moos-ivp/moos-ivp/commit/477be7e91bf220185d55e5a2a9dba16dbde32c3f",
        "target": {
            "file": "ivp/src/lib_mbutil/ReleaseInfo.cpp"
        }
    }
]

vanir_signatures_modified

"2026-09-06T08:03:30Z"