CVE-2026-40162: Authenticated Arbitrary File Write in Bugsink Artifact Assembly
Vulnerability ID: CVE-2026-40162
CVSS Score: 7.1
Published: 2026-04-10
An authenticated arbitrary file write vulnerability exists in Bugsink 2.1.0 within the artifact bundle assembly workflow. Attackers can leverage the checksum parameter to execute path traversal attacks, allowing the writing of arbitrary data to the filesystem before the application validates the checksum.
TL;DR
Bugsink 2.1.0 fails to sanitize the checksum parameter during artifact bundle assembly, permitting authenticated attackers to write arbitrary files via path traversal. This leads to remote code execution. The vulnerability is fixed in version 2.1.1.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22, CWE-20
- Attack Vector: Network
- CVSS Score: 7.1 (High)
- Impact: Arbitrary File Write / Remote Code Execution
- Exploit Status: Proof of Concept
- KEV Status: Not Listed
Affected Systems
- Bugsink 2.1.0
-
Bugsink: 2.1.0 (Fixed in:
2.1.1)
Code Analysis
Commit: 29e46f3
Core security fix for arbitrary file write
Commit: 1fc1076
Regression test for vulnerability
Exploit Details
- GitHub (Regression Test): Official unit test demonstrating the path traversal payload
Mitigation Strategies
- Upgrade Bugsink to version 2.1.1
- Implement WAF rules to validate the format of the 'checksum' parameter in API requests
- Run the Bugsink application with the principle of least privilege, restricting its filesystem write access
Remediation Steps:
- Download the Bugsink 2.1.1 release package.
- Stop the running Bugsink service and background workers.
- Apply the version 2.1.1 update according to official installation procedures.
- Restart the Bugsink service.
- Verify the application logs for successful startup and absence of checksum validation errors.
References
Read the full report for CVE-2026-40162 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)