CVE-2026-92748 in Empire
Summary
by MITRE • 09/16/2026
BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
BC Security Empire versions prior to 6.7.1 contain a critical security flaw related to improper input validation within its file upload functionality. The vulnerability specifically targets multipart form data processing where the system fails to adequately sanitize or validate the filename parameter provided by authenticated users during file uploads. This lack of rigorous checking allows an attacker who has obtained valid operator credentials to manipulate the filesystem structure on the Command and Control server through path traversal techniques. By injecting directory traversal sequences such as dot-dot-slash into the filename field, the application incorrectly interprets these characters as part of the intended save location rather than rejecting them or normalizing the path securely.
The operational impact of this vulnerability is severe because it effectively grants an authenticated attacker arbitrary write access to the server's filesystem. While authentication provides a baseline level of trust in many systems, Empire operators are often granted significant privileges necessary for managing C2 infrastructure and executing commands against compromised hosts. When combined with the ability to bypass directory containment restrictions, these privileges allow the attacker to place files outside of intended upload directories. This capability enables the placement of malicious scripts, web shells, or compiled binaries into sensitive system locations where they can be executed by other processes or accessed via web services running on the same host.
From a technical perspective, this flaw represents a classic case of path traversal leading to remote code execution potential. The failure lies in the application logic that constructs file paths using unsanitized user input without applying canonicalization checks or restricting writes to whitelisted directories. This aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within a pathname so that it affects the intended directory structure. Furthermore, because this vulnerability facilitates the deployment of malicious artifacts for persistent access and further exploitation, it maps directly to MITRE ATT&CK technique T1505 Server Software Component Web Shell, as attackers can use this mechanism to establish backdoors on the C2 server itself.
Mitigation strategies must prioritize immediate patching to version 6.7.1 or later where these validation checks have been implemented by BC Security. In environments where upgrading is not immediately feasible, defensive measures should include implementing strict input validation at the web application firewall level to block requests containing path traversal sequences in filename parameters. Additionally, restricting file upload permissions so that the service account running Empire has minimal write access can limit the blast radius of such an exploit. Regular auditing of uploaded files and monitoring for unusual file creation events in sensitive directories are also recommended to detect potential exploitation attempts early.