PX4 PX4-Autopilot up to 1.17.0-rc1 Path Validation path traversal

Summaryinfo

A vulnerability was found in PX4 PX4-Autopilot up to 1.17.0-rc1. It has been classified as critical. This impacts an unknown function of the component Path Validation Handler. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-32709. The attack requires being on the local network. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in PX4 PX4-Autopilot up to 1.17.0-rc1 and classified as critical. This issue affects an unknown code block of the component Path Validation Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem without authentication. On NuttX targets, the FTP root directory is an empty string, meaning attacker-supplied paths are passed directly to filesystem syscalls with no prefix or sanitization for read operations. On POSIX targets (Linux companion computers, SITL), the write-path validation function unconditionally returns true, providing no protection. A TOCTOU race condition in the write validation on NuttX further allows bypassing the only existing guard. This vulnerability is fixed in 1.17.0-rc2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-32709 since 03/13/2026. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 1.17.0-rc2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• PX4

Name

• PX4-Autopilot

Version

• 1.17.0-rc1

Website

• Product: https://github.com/PX4/PX4-Autopilot/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion