External Control of File Name Path in Apache bRPC

CVE-2026-86147

What is CVE-2026-86147?

This vulnerability in Apache bRPC allows remote attackers with access to the built-in service port to manipulate file paths and create unauthorized directories. The issue stems from the /flags service’s lack of proper validation, permitting attackers to modify dump paths and potentially overwrite critical files with server privileges. Additionally, an improperly controlled parameter in the /pprof service can cause significant resource depletion. Servers exposing these services inadvertently to untrusted networks are particularly at risk. It's essential for users to upgrade to version 1.18.0, or apply the official patch to mitigate these risks.

References