Path Traversal Vulnerability in PX4 Autopilot Flight Control Solution

CVE-2026-32709

What is CVE-2026-32709?

The PX4 Autopilot's implementation of MAVLink FTP prior to version 1.17.0-rc2 is susceptible to an unauthenticated path traversal vulnerability. This flaw allows unauthorized MAVLink peers to manipulate the flight controller's filesystem without proper authentication, enabling them to read, write, create, delete, and rename files. On NuttX targets, the FTP root directory is improperly defined, which results in attacker-controlled paths being used directly in filesystem calls without adequate sanitization. Similarly, on POSIX targets, a lack of validation in the writing process further exacerbates the issue, permitting attackers to exploit the system with little effort. The vulnerability has been addressed in the updated version 1.17.0-rc2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References