→

CVE-2026-42085: OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42085

CVE-2026-42085:

4.3

CVSS Score

3.1

-

CVSS Score

-

Basic Information

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openc3	rubygems	< 6.10.5	6.10.5
openc3	rubygems	>= 7.0.0.pre.rc1, < 7.0.0-rc3	7.0.0-rc3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ToolConfigModel classes in both the Ruby and Python backends of OpenC3 COSMOS. The core issue is a lack of input validation on the tool and name parameters used in functions that manage tool configurations (save_config, load_config, list_configs, delete_config). An attacker could provide specially crafted strings containing path traversal sequences (e.g., ../) as the configuration name. The save_config function would then pass this malicious name to LocalMode.save_tool_config, which constructs a file path and writes a file. Without validation, this allows writing files to arbitrary locations within the /plugins directory, potentially overwriting existing plugin configurations and leading to a compromise of other plugins' functionality. The patches introduce strict validation, first with a denylist and then improved with an allowlist, on the tool and name parameters in all related ToolConfigModel functions to ensure they do not contain any path traversal or other malicious characters.

Vulnerable functions

OpenC3::ToolConfigModel.save_config

openc3/lib/openc3/models/tool_config_model.rb

This function saves a tool configuration. Before the patch, it did not validate the 'tool' and 'name' parameters for path traversal characters. A malicious user could provide a crafted 'name' like '../../newconfig.json' to write a configuration file outside the intended directory, leading to arbitrary file writes within the '/plugins' directory.

ToolConfigModel.save_config

openc3/python/openc3/models/tool_config_model.py

This function saves a tool configuration. Before the patch, it did not validate the 'tool' and 'name' parameters for path traversal characters. A malicious user could provide a crafted 'name' like '../../newconfig.json' to write a configuration file outside the intended directory, leading to arbitrary file writes within the '/plugins' directory.

OpenC3::ToolConfigModel.list_configs

openc3/lib/openc3/models/tool_config_model.rb

This function lists configurations for a tool. It was vulnerable to path traversal because it didn't validate the 'tool' parameter, allowing an attacker to list configs from other tools or directories.

OpenC3::ToolConfigModel.load_config

openc3/lib/openc3/models/tool_config_model.rb

This function loads a tool configuration. It was vulnerable to path traversal because it didn't validate the 'tool' and 'name' parameters, allowing an attacker to read configuration files from unintended locations.

OpenC3::ToolConfigModel.delete_config

openc3/lib/openc3/models/tool_config_model.rb

This function deletes a tool configuration. It was vulnerable to path traversal because it didn't validate the 'tool' and 'name' parameters, allowing an attacker to delete configuration files from unintended locations.

ToolConfigModel.list_configs

openc3/python/openc3/models/tool_config_model.py

This function lists configurations for a tool. It was vulnerable to path traversal because it didn't validate the 'tool' parameter, allowing an attacker to list configs from other tools or directories.

ToolConfigModel.load_config

openc3/python/openc3/models/tool_config_model.py

This function loads a tool configuration. It was vulnerable to path traversal because it didn't validate the 'tool' and 'name' parameters, allowing an attacker to read configuration files from unintended locations.

ToolConfigModel.delete_config

openc3/python/openc3/models/tool_config_model.py

This function deletes a tool configuration. It was vulnerable to path traversal because it didn't validate the 'tool' and 'name' parameters, allowing an attacker to delete configuration files from unintended locations.

Vulnerability Intelligence
Miggo AI

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42085: OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

CVE-2026-42085:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

4.3

4.3

CVE-2026-42085: OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-42085: OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

CVE-2026-42085:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

4.3

4.3

CVE-2026-42085: OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI