Description

Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T20:19:20.240Z",
  "pubdate": "2026-09-15T20:19:20.240Z",
  "executiveSummary": "Tencent Mass Service Engine in Cluster (MSEC) is susceptible to a critical path traversal vulnerability that enables unauthenticated remote code execution with root-level privileges.\nThe vulnerability originates from improper validation of user-supplied input within POST requests, allowing an attacker to manipulate file paths via directory traversal sequences.\nBy successfully injecting '../' sequences, an attacker can escape the intended directory structure to perform arbitrary file uploads, specifically targeting the deployment of malicious webshells.\nThis flaw grants full administrative control over the affected system, as the service executes with root privileges. The exposure poses a severe risk to confidentiality, integrity, and availability, as unauthorized actors can execute arbitrary system commands, exfiltrate sensitive data, or pivot within the internal network infrastructure.\nExploitation does not require prior authentication, significantly lowering the barrier to entry for malicious actors. Immediate remediation is required to restrict unauthorized file system access and prevent complete host compromise.",
  "technicalDetails": "The root cause of this vulnerability is a lack of robust input sanitization and directory path validation within the Tencent Mass Service Engine in Cluster (MSEC) web interface. Specifically, the application fails to adequately filter directory traversal characters, such as '../', when processing incoming POST requests.\nThe attack flow commences when an unauthenticated remote attacker sends a maliciously crafted HTTP POST request to the MSEC service. By embedding traversal sequences within the request parameters or file upload fields, the attacker forces the application to resolve file paths outside of the designated secure storage directory.\nThis path manipulation allows the attacker to place a malicious script—commonly referred to as a webshell—into an executable web directory on the server. Because the MSEC service daemon runs with root privileges, any file saved to the disk inherits these elevated permissions. Once the webshell is written to a location accessible via the web server, the attacker can execute arbitrary system commands by sending subsequent requests to the uploaded file.\nThe payload behavior involves overwriting existing configuration files or creating new ones to facilitate remote execution. Once the webshell is activated, the attacker gains the ability to interact with the underlying operating system directly, bypassing any application-level security controls. Given the root context, the attacker has unfettered access to the entire file system, memory, and kernel processes.\nPost-exploitation impact includes persistent backdooring of the device, lateral movement into the broader cluster environment, and full administrative takeover. Since the service is designed for cluster management, a compromise of a single node via this vulnerability can serve as a beachhead for a larger-scale attack against the entire service infrastructure. The lack of authentication requirements facilitates automated exploitation attempts by botnets or opportunistic adversaries scanning for exposed MSEC instances."
}