# Unsantized path in file operations

User or config names reaching open/write/delete sinks without traversal checks

_Area: Network devices and IoT. Seen in 3 disclosed reports; one confirmed bounty: $750; latest 2026-10-14. Updated 2026-10-23._

## How it works
A name that a user, API caller, or config value controls is joined onto a base directory and handed to a file operation (open, write, delete) without rejecting `..` or absolute paths. The code assumes the name is a harmless label, but it is really a path. Traversal sequences then escape the intended directory, so the operation lands on any file the process can reach — often as root, sometimes pre-auth.

## Where it shows up
- A settable cvar or config key names a file (`mapcyclefile`, auto-script object name) and is passed straight to a filesystem call [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md)[E2](https://bugbountylibrary.com/r/h1%3A590279.md).
- Request parameters (`textdomain`, `token`) used to build file paths on an appliance's web portal [E3](https://bugbountylibrary.com/r/h1%3A924407.md).
- The same value feeding both a read path and a write/delete path [E2](https://bugbountylibrary.com/r/h1%3A590279.md)[E3](https://bugbountylibrary.com/r/h1%3A924407.md).
- A management-protocol handler that accepts a name and writes it as root [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md).

## How to review
Find every file sink and trace its path argument back to input. The invariant: after joining, the resolved canonical path (realpath) must still sit inside the intended base directory, and the name must contain no `..`, no absolute prefix, and no encoded traversal. Check both read and write/delete callers of the same value. For config-driven names, verify the setter validates before storing, not just the consumer. Confirm the process privilege level — root or unauthenticated makes it far worse [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md)[E3](https://bugbountylibrary.com/r/h1%3A924407.md).

## Variants seen
- Auto-script object name unsanitized, letting traversal write files as root anywhere on the filesystem [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md).
- RCON-authenticated cvar feeding both read and write file operations [E2](https://bugbountylibrary.com/r/h1%3A590279.md).
- Unauthenticated traversal in appliance portal parameters enabling arbitrary read and delete [E3](https://bugbountylibrary.com/r/h1%3A924407.md).

## Impact and severity
Arbitrary file read (credential/secret disclosure) and write/delete (implant placement, config tampering, denial of service). Severity rises sharply when pre-auth or root: E1 saw memory-resident implants on 500+ devices; E3 allowed unauthenticated read and delete. Centralized managers amplify blast radius because their trust material covers every managed device [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware.md
- E2: https://bugbountylibrary.com/r/h1%3A590279.md
- E3: https://bugbountylibrary.com/r/h1%3A924407.md