---
id: CVE-2026-61738
title: >-
  SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in
  the ScoutSuite GCP Report Upload (RCE)
summary: >-
  SOCFortress CoPilot focuses on providing a single pane of glass for all your
  security operations needs. Prior to 0.1.77, `POST
  /api/scoutsuite/generate-gcp-report` in
  `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admi…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-73
  - CWE-434
vendor: socfortress
product: CoPilot
affected:
  - CoPilot < 0.1.77
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T21:36:52.249735Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:37:15.231Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61738'
references:
  - url: >-
      https://github.com/socfortress/CoPilot/security/advisories/GHSA-q3g8-3cf7-744f
    label: >-
      https://github.com/socfortress/CoPilot/security/advisories/GHSA-q3g8-3cf7-744f
  - url: 'https://github.com/socfortress/CoPilot/pull/940'
    label: 'https://github.com/socfortress/CoPilot/pull/940'
  - url: 'https://github.com/socfortress/CoPilot/pull/941'
    label: 'https://github.com/socfortress/CoPilot/pull/941'
  - url: >-
      https://github.com/socfortress/CoPilot/commit/1881ef8d28bc7f45ffa88d7ba4fcca7302355508
    label: >-
      https://github.com/socfortress/CoPilot/commit/1881ef8d28bc7f45ffa88d7ba4fcca7302355508
  - url: >-
      https://github.com/socfortress/CoPilot/commit/bfa630b65d554670c7462a32ce6fd4e3cbd0254c
    label: >-
      https://github.com/socfortress/CoPilot/commit/bfa630b65d554670c7462a32ce6fd4e3cbd0254c
  - url: 'https://github.com/socfortress/CoPilot/tree/v0.1.77'
    label: 'https://github.com/socfortress/CoPilot/tree/v0.1.77'
tags:
  - cve.org
  - exploit-available
epss: 0.00558
epssPercentile: 0.46667
ingestedAt: '2026-11-05T16:07:30.309Z'
---

## Overview

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.

## Affected

- `CoPilot < 0.1.77`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.