Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85456MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows
Medium 5.5
In plain English
A medium-severity path traversal in moos-ivp from moos-ivp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- Pull Request #137 issue-tracking, patch
- Proposed fix commit (pull request not merged) patch
- https://github.com/moos-ivp/moos-ivp product
- SplitHandler.cpp (verified sink) technical-description
- VulnCheck Advisory: MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows third-party-advisory