CVE-2026-92604

Scirius through 3.8.0 contains an arbitrary file write flaw (CWE-22) in its PCAP filestore upload endpoint. An authenticated attacker holding only the default User role can embed path traversal sequences in an uploaded document's _id field, causing the server to escape the intended storage directory. The attacker-controlled JSON content is then written with a .json extension to arbitrary filesystem locations, and the write occurs with root privileges, giving the attacker high integrity and availability impact on the host (CVSS 4.0: 7.2 High, network-vector, low privileges required). Any organization running Scirius 3.8.0 or earlier, typically deployed to manage Suricata rulesets in SELKS or Stamus NSM environments, is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported to date.

What to do: Upgrade Scirius to a release newer than 3.8.0 as soon as a patched version is available from Stamus Networks. Until then, restrict User-role accounts in the Scirius UI to trusted operators, keep the console off the public internet, and audit the filesystem for unexpected .json files outside the PCAP filestore directory (especially in cron, systemd, or application config paths) to detect potential abuse.