CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal flaw (CWE-22/23) in its REST API, where user-controlled identifiers supplied to create, update, or delete Self-orchestrator resources were inserted into filesystem paths without validation or sanitization. An unauthenticated remote attacker who can reach the Self-orchestrator API can send identifiers containing path traversal sequences (path separators and relative-path components) to write or delete JSON files outside the intended application directories. Because the affected API requires no authentication and, in the affected deployment configuration, the container runs with elevated privileges, an attacker can tamper with or remove files beyond the orchestrator's own directories, producing high integrity and availability impact (CVSS 4.0 base 8.8, with no confidentiality impact). Any deployment running a version before 1.2.1 with the REST API exposed to untrusted networks is affected. There is no known exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA KEV, with EPSS estimating roughly a 0.6% chance of exploitation within 30 days.

What to do: Upgrade Eclipse aeriOS Self-orchestrator to version 1.2.1, which adds validation and sanitization of identifiers used to construct filesystem paths. Until upgrading, restrict network access to the Self-orchestrator REST API to trusted clients only and avoid running the container with elevated privileges. Also check for unexpected or modified JSON files outside the orchestrator's intended directories, which would indicate attempted path traversal writes or deletions.