CVE-2026-92748— BC Security Empire 6.7.1前路径遍历RCE漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

BC-SECURITY Empire

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass di

CVE-2026-92748 影响 BC-SECURITY Empire。尚无明确在野利用证据，仍需结合暴露面评估。BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 CVE-2026-92748 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-92748

一、 漏洞 CVE-2026-92748 基础信息

受影响产品

二、漏洞 CVE-2026-92748 的公开POC

三、漏洞 CVE-2026-92748 的情报信息

CVE-2026-92748 其他参考 (6)

• GitHub - BC-SECURITY/Empire: Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. · GitHub product
• [BUG] Path traversal arbitrary file write in download/avatar upload (download_service.create_download) leads to remote code execution on the C2 host · Issue #824 · BC-SECURITY/Empire issue-tracking
• Release v6.7.1 · BC-SECURITY/Empire · GitHub release-notes
• fix(api): block path traversal in file upload endpoints (#824) (#1549) · BC-SECURITY/Empire@c33a626 · GitHub patch
• BC Security Empire before 6.7.1 Path Traversal File Upload RCE | Advisories | VulnCheck third-party-advisory
• Empire/empire/server/core/download_service.py at v6.6.0 · BC-SECURITY/Empire · GitHub technical-description

• https://www.cve.org/CVERecord?id=CVE-2026-92748

IV. Related Vulnerabilities

V. Comments for CVE-2026-92748