Full Report
A vulnerability has been found in EAP Legislator software that allows a file archive to be extracted outside the target directory (CVE-2026-1186).
Analysis Summary
# Vulnerability: Path Traversal in EAP Legislator File Extraction
## CVE Details
- CVE ID: CVE-2026-1186
- CVSS Score: Information not provided (Severity based on description: High impact)
- CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
## Affected Systems
- Products: ABC PRO EAP Legislator
- Versions: All through version 2.25
- Configurations: Functionality involving the opening/extraction of zipx archives.
## Vulnerability Description
The EAP Legislator software is vulnerable to a Path Traversal flaw within its file extraction mechanism. An attacker can craft a malicious zipx archive (the default file type used by the application). When a victim opens this archive, files within the archive can be extracted to an arbitrary path outside the intended, restricted target directory, such as system startup directories.
## Exploitation
- Status: Not enough information provided; assumed potential.
- Complexity: Low (Requires creation of a malicious archive and social engineering to get the victim to open it).
- Attack Vector: Local Access (User interaction required).
## Impact
- Confidentiality: Potential unauthorized disclosure if sensitive files are overwritten or accessed during extraction.
- Integrity: High. Arbitrary file write capability allows for system file modification or credential theft if the extraction location is sensitive (e.g., startup scripts).
- Availability: Potential Denial of Service if critical system files are overwritten or corrupted.
## Remediation
### Patches
- Version 2.25a addresses this specific vulnerability.
### Workarounds
- No specific workarounds were detailed in the source material beyond patching.
- **Mitigation Strategy:** Users should avoid opening zipx archives from untrusted sources until patched.
## Detection
- **Indicators of Compromise:** Look for unexpected files appearing in restricted system directories, especially startup or configuration folders, immediately following the use of the EAP Legislator application to open an archive.
- **Detection Methods and Tools:** File integrity monitoring (FIM) on critical system directories.
## References
- Vendor Advisory: ABC PRO (Implicit via coordination with CERT Polska)
- CERT Polska CVD Process: https://cert.pl/en/cvd/
- CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-1186