Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4aqm-vnhk-83cc
Vulnerability ID VCID-4aqm-vnhk-83cc
Aliases CVE-2026-42085
GHSA-4jvx-93h3-f45h
Summary OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-23 Relative Path Traversal
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2026-42085
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2026-42085
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2026-42085
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2026-42085
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-4jvx-93h3-f45h
cvssv3.1 4.3 https://github.com/OpenC3/cosmos
generic_textual MODERATE https://github.com/OpenC3/cosmos
cvssv3.1 4.3 https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
generic_textual MODERATE https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
ssvc Track https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
cvssv3.1 4.3 https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
generic_textual MODERATE https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
ssvc Track https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
cvssv3.1 4.3 https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
generic_textual MODERATE https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
ssvc Track https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
cvssv3.1 4.3 https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
generic_textual MODERATE https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
ssvc Track https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
cvssv3 4.3 https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
cvssv3.1 4.3 https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
cvssv3.1_qr MODERATE https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
generic_textual MODERATE https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
ssvc Track https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
cvssv3.1 4.3 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42085.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42085.yml
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2026-42085
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-42085
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-42085
https://github.com/OpenC3/cosmos
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42085.yml
https://nvd.nist.gov/vuln/detail/CVE-2026-42085
9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5 https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
e6efccbd148ba0e3361c5891027f2373aa140d42 https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
GHSA-4jvx-93h3-f45h https://github.com/advisories/GHSA-4jvx-93h3-f45h
GHSA-4jvx-93h3-f45h https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
v6.10.5 https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
v7.0.0-rc3 https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-04T18:43:28Z/ Found at https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-04T18:43:28Z/ Found at https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-04T18:43:28Z/ Found at https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-04T18:43:28Z/ Found at https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-04T18:43:28Z/ Found at https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42085.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42085
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17833
EPSS Score 0.00056
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:20.391890+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/42xxx/CVE-2026-42085.json 38.6.0