Description

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-26T10:16:40.893Z",
  "pubdate": "2026-08-26T10:16:40.893Z",
  "executiveSummary": "OpenRGB versions through 1.0rc3 are susceptible to an arbitrary file overwrite vulnerability stemming from the unsafe handling of the SAVE_PROFILE message. This vulnerability allows a local attacker to manipulate file system operations, potentially resulting in the overwriting of arbitrary files with user-controlled data. The flaw resides in the application's processing logic for network messages, which fails to adequately validate or sanitize file path inputs provided during a profile save operation. If exploited, an attacker could overwrite sensitive configuration files, system binaries, or user data, leading to a compromise of application integrity or potentially facilitating further system-level escalation. The vulnerability is characterized as an improper input validation issue, specifically concerning path traversal or insecure file handling primitives. Given the nature of the application, which often runs with elevated privileges to interact with hardware peripherals, the impact of such an overwrite is significant. Successful exploitation requires the ability to send malicious network messages to the OpenRGB server component. Remediation necessitates the implementation of strict input sanitization, path normalization, and restricted file system access controls to prevent directory traversal and unauthorized file modification.",
  "technicalDetails": "The vulnerability is identified within the network protocol handler responsible for processing the SAVE_PROFILE message in OpenRGB versions up to 1.0rc3. The root cause is the lack of proper validation on the file path parameters supplied within the SAVE_PROFILE request. When the application receives this message, it incorrectly processes the provided string as a file destination without enforcing containment within an intended directory or verifying the target file's identity.\nThe attack flow begins when an attacker transmits a maliciously crafted SAVE_PROFILE message to the OpenRGB service, which typically listens on a network port. By injecting directory traversal sequences (e.g., '../') into the file path field of the message, an attacker can escape the designated profile directory. The vulnerable component, acting with the privileges of the OpenRGB process—which often requires root or administrative access to communicate with I2C/SMBus or USB devices—performs the file write operation at the attacker-specified location.\nDuring the exploitation process, the application interprets the untrusted input and attempts to write profile data to the disk. Because the application fails to resolve or sanitize the path, the file system API is invoked with the manipulated path. If the OpenRGB service possesses sufficient system permissions, it will overwrite any file that the service user is authorized to modify. This behavior allows for a wide range of post-exploitation possibilities, including the corruption of configuration files to alter application behavior, the overwriting of library files to facilitate code execution, or the deletion of critical system files.\nThis vulnerability does not strictly require complex binary exploitation techniques such as memory corruption or buffer overflows; rather, it relies on the logical failure of the application to enforce security boundaries on input parameters. The lack of authentication or access control for the network interface in early versions of OpenRGB exacerbates this risk, as any entity capable of establishing a network connection to the service can trigger the arbitrary file overwrite. Impact assessment indicates that the confidentiality, integrity, and availability of the host system are compromised, specifically regarding the files accessible to the service process. The absence of input sanitization makes this a classic path traversal to arbitrary file write scenario, demanding strict path validation logic or the usage of secure sandboxed file operations to mitigate."
}