CVE-2026-92748
BC Security Empire before 6.7.1 Path Traversal File Upload RCE
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.
| CWE | CWE-22 |
| Vendor | bc-security |
| Product | empire |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for bc-security empire
Be the first to know when new high vulnerabilities affecting bc-security empire are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
BC-SECURITY / Empire
0 < 6.7.1
References
github.com: https://github.com/BC-SECURITY/Empire/issues/824 github.com: https://github.com/BC-SECURITY/Empire github.com: https://github.com/BC-SECURITY/Empire/blob/v6.6.0/empire/server/core/download_service.py#L148-L193 github.com: https://github.com/BC-SECURITY/Empire/commit/c33a626316cb20bc8ed707e03a22d324d5d4762a github.com: https://github.com/BC-SECURITY/Empire/releases/tag/v6.7.1 vulncheck.com: https://www.vulncheck.com/advisories/bc-security-empire-before-6.7.1-path-traversal-file-upload-rce
Credits
George Chen