CVE-2026-67970: Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-67970
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-67970 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Incorrect access control
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-67975: Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index s…nvd · 2026-08-03
- mediumCVE-2026-28147: Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr…nvd · 2026-08-03
- mediumCVE-2026-6792: Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incor…nvd · 2026-07-21
- mediumCVE-2026-51083: Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and…nvd · 2026-07-17
- mediumCVE-2026-36035: Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalP…nvd · 2026-07-14
- criticalCVE-2026-51538: EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerabi…nvd · 2026-07-13
More from NVD Recent CVEs
- unknownCVE-2026-69249: python-cryptography is a package designed to expose cryptographic primitives and recipes to Py…2026-08-03
- unknownCVE-2026-69248: cryptography is a package designed to expose cryptographic primitives and recipes to Python de…2026-08-03
- unknownCVE-2026-69247: cryptography is a package designed to expose cryptographic primitives and recipes to Python de…2026-08-03
- unknownCVE-2026-67977: An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2…2026-08-03
- unknownCVE-2026-67975: Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index s…2026-08-03