Path Traversal Vulnerability in Eclipse aeriOS Self-orchestrator

CVE-2026-85199

What is CVE-2026-85199?

The aeriOS Self-orchestrator from Eclipse is subjected to a serious security vulnerability due to improper validation of user-controlled identifiers in its REST API. This flaw permits an unauthenticated remote attacker to execute path traversal attacks, allowing them to manipulate filesystem paths. By sending manipulated identifiers, attackers can potentially write or delete important JSON files outside the designated application directories. The exploitability is exacerbated by the lack of authentication on the API and the elevated privileges of the container in the default deployment configuration. To mitigate this risk, version 1.2.1 introduces comprehensive validation and sanitization of identifiers, preventing malicious path manipulation.

References