CVE-2026-85456
MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
| CWE | CWE-22 |
| Vendor | moos-ivp |
| Product | moos-ivp |
| Published | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for moos-ivp moos-ivp
Be the first to know when new medium vulnerabilities affecting moos-ivp moos-ivp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
moos-ivp / moos-ivp
0 ≤ 24.8.1
References
github.com: https://github.com/moos-ivp/moos-ivp/pull/137 github.com: https://github.com/moos-ivp/moos-ivp/commit/6f0619e905b325d6b88f76425673045c6e4f6f94 github.com: https://github.com/moos-ivp/moos-ivp github.com: https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_logutils/SplitHandler.cpp#L189 vulncheck.com: https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-alog-splitting-path-traversal-on-windows
Credits
Vlatko Kosturjak