Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92604Scirius through 3.8.0 Arbitrary File Write via PCAP Upload

High 8.1

In plain English

A high-severity path traversal in scirius from StamusNetworks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.

Affected products (as reported)

Vendor	Product	Versions
StamusNetworks	scirius	0 – through 3.8.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/geo-chen/oss/blob/main/scirius.md third-party-advisory
https://github.com/StamusNetworks/scirius product
https://github.com/StamusNetworks/scirius/blob/3bb49d383f4801b79e6356f9de9f25806afe0311/suricata/rest_api.py#L105-L113 technical-description
VulnCheck Advisory: Scirius through 3.8.0 Arbitrary File Write via PCAP Upload third-party-advisory