Vulnerability · Published Feb 13, 2026 · Assigned by GitHub_M

CVE-2026-21878BACnet Stack Improperly Limits Pathnames to a Restricted Directory

High 7.5

In plain English

A high-severity path traversal in bacnet-stack from bacnet-stack. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3.

Affected products (as reported)

Vendor	Product	Versions
bacnet-stack	bacnet-stack	< 1.5.0.rc3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/commit/c5dc00a77b4bc2550befa67a930b333e299c18f3 x_refsource_MISC