CVE-2026-78299 in Embedded CDT
Summary
by MITRE • 09/14/2026
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Eclipse Embedded CDT versions ranging from 6.0 through 6.7 represents a critical path traversal flaw within the software update mechanism that handles CMSIS-Pack archives. This issue stems from an insufficient validation of file paths during the extraction process, allowing maliciously crafted archive files to escape their designated directory boundaries. When a user or automated system processes a compromised CMSIS pack, which is essentially a compressed archive format used for distributing embedded development components, the application fails to properly sanitize the internal file paths contained within the zip structure. This lack of rigorous path normalization enables an attacker to utilize standard directory traversal sequences, such as dot-dot-slash characters, to manipulate the destination path where files are written on the host system's filesystem.
From a technical perspective, this flaw aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core issue lies in the extraction logic not verifying that the resolved absolute path of each file remains within the intended target directory for the CMSIS pack installation. By constructing archive entries with relative paths that ascend beyond the root of the package directory, an attacker can redirect write operations to arbitrary locations on the disk. This behavior bypasses the sandboxing or isolation typically expected when installing third-party plugins or component packs into a development environment like Eclipse.
The operational impact of this vulnerability is severe due to its potential for remote code execution and system compromise. An attacker who controls the content of a CMSIS pack, which could be achieved by compromising a repository hosting these packages or through a targeted supply chain attack, can force the extraction process to overwrite critical system files, configuration files, or executable binaries located outside the plugin directory. This capability allows for the installation of persistent backdoors, modification of development tools to introduce further vulnerabilities, or complete takeover of the developer's workstation if sufficient file permissions are present. Since Eclipse Embedded CDT is widely used in embedded systems development, compromising this toolchain can have downstream effects on the security and integrity of firmware projects built using these compromised environments.
This vulnerability also maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter or potentially T1204 if it leads to user execution of malicious artifacts placed in accessible directories. The attack vector is primarily remote via network access to a repository hosting the malicious pack, followed by local exploitation when the victim initiates the installation or update process within the IDE. This classification highlights the risk associated with trusting external sources for development dependencies without adequate integrity checks at the extraction layer.
Mitigation strategies must focus on immediate patching and enhanced validation practices. The primary remediation is to upgrade Eclipse Embedded CDT to a version later than 6.7, where this path traversal flaw has been addressed by implementing strict path canonicalization before file creation. Developers should ensure that their build environments are updated regularly to incorporate security fixes for all integrated tools. In the interim, or as an additional layer of defense, organizations should implement network-level controls to restrict access to unverified repositories and enforce code signing policies for CMSIS packs where possible. Furthermore, running IDEs with restricted file system permissions can limit the blast radius if a traversal attempt occurs, preventing writes to critical system directories even if the path validation fails. Security teams should also monitor for unusual file creation patterns in development environments that do not correspond to standard plugin installation paths.