Description

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T13:18:46.870Z",
  "pubdate": "2026-09-14T13:18:46.870Z",
  "executiveSummary": "This vulnerability is an arbitrary file write flaw categorized as a Path Traversal vulnerability (CWE-22).\nIt affects Eclipse Embedded CDT versions 6.0 through 6.7.\nThe issue exists within the CMSIS-Pack archive extraction functionality, where improper validation of archive entries allows for the creation of files outside the intended destination directory.\nAn attacker can exploit this by crafting a malicious CMSIS-Pack archive containing entry paths with traversal sequences (e.g., '../').\nUpon extraction, the application fails to sanitize these paths, leading to the arbitrary writing of files to the host system with the privileges of the application process.\nThe risk implication is critical, as this could allow for remote code execution, file system corruption, or the overwriting of sensitive configuration files, depending on the environment where the tool is running and the permissions associated with the user executing the extraction.",
  "technicalDetails": "The vulnerability resides in the archive handling component responsible for processing CMSIS-Pack files within Eclipse Embedded CDT versions 6.0 to 6.7.\nThe root cause is insufficient input validation and sanitization of file paths contained within the archive entries during the extraction process. Specifically, the application logic fails to verify whether the target destination path of an entry, once joined with the base extraction directory, resides within the designated, secure root folder.\nExploitation is achieved through the use of malicious archives that leverage Zip Slip-style directory traversal techniques. An attacker can craft a CMSIS-Pack archive where one or more file entries possess path names containing upward traversal sequences, typically represented as '../'.\nWhen the affected component parses and extracts these entries, it fails to normalize or restrict the resulting file paths. Consequently, the operating system's file system API treats the traversal sequences as instructions to traverse up the directory tree relative to the extraction target. This permits the attacker to write files to arbitrary locations on the file system, constrained only by the security context and filesystem permissions of the user process executing the Eclipse Embedded CDT component.\nThe attack flow follows a structured sequence: 1) The attacker distributes a compromised CMSIS-Pack archive file to a target user. 2) The user initiates the archive extraction process within the vulnerable version of Eclipse Embedded CDT. 3) The application iterates through the files within the archive. 4) The application encounters an entry with a malicious, path-traversed filename. 5) The extraction routine concatenates this unsafe path directly to the destination path without validation. 6) The file is written to the attacker-specified location outside the intended boundary. 7) If the attacker targets executable files, startup scripts, or configuration files, they can achieve persistent code execution or system compromise upon the next system or application restart.\nThere are no specific authentication or specialized privilege requirements for exploitation; the vulnerability is triggered whenever the application processes an untrusted archive, making it highly dangerous for users performing standard development tasks."
}