CVE-2026-61738: Path Traversal in SOCFortress CoPilot

CVE-2026-61738 is a path traversal vulnerability in SOCFortress CoPilot, a security operations platform. The flaw resides in the POST /api/scoutsuite/generate-gcp-report endpoint: the code does not sanitize the filename from the multipart upload header and passes it directly to os.path.join. An authenticated attacker with admin or analyst privileges can supply a filename with traversal paths (such as ../) to write the JSON file outside the intended directory, overwriting critical application files.

The vulnerability has a CVSS score of 10.0 (maximum), classified as critical. The severity stems from the application running with root privileges, allowing JSON content to overwrite critical files and cause service disruption. A patch was released in version 0.1.77, which removes caller-controlled filenames from the affected endpoint. The vulnerability was described in NVD on 2026-10-30, with social signals present within the last 24 hours.

Administrators of SOCFortress CoPilot must update immediately to version 0.1.77 or later. If immediate update is not possible, restrict access to the POST /api/scoutsuite/generate-gcp-report endpoint to trusted users only and review access logs for suspicious uploads. Verify that critical application files have not been modified; in high-sensitivity environments, consider deploying WAF or additional access controls that validate filenames before saving.