An unauthenticated path traversal vulnerability in Eclipse aeriOS Self-orchestrator poses a high risk of unauthorized file system modification and deletion.

This is a path traversal vulnerability (CWE-22) in the REST API where user-controlled identifiers are not properly sanitized before being used in filesystem operations. The vulnerability is accessible to unauthenticated remote attackers and is amplified by the application running with elevated container privileges.

The ability for an unauthenticated attacker to write or delete JSON configuration files or other system resources can lead to critical service disruption, unauthorized modification of application behavior, or potential escalation of privileges. With a CVSS score of 8.8, this vulnerability represents a high risk to business continuity and data integrity, particularly where the application is deployed in environments with excessive container permissions.

Immediate Action: Upgrade to Eclipse aeriOS Self-orchestrator version 1.2.1 or later immediately to implement proper input validation and path sanitization.

Proactive Monitoring: Monitor API access logs for suspicious patterns, specifically looking for path traversal sequences such as double dots (..) or absolute path identifiers in resource request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences or unconventional characters in API identifiers. Restrict container filesystem permissions to the minimum necessary to reduce the impact of successful exploitation.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for remote, unauthenticated file system manipulation, organizations should prioritize patching this vulnerability as a matter of urgency. Administrators must ensure that the update to version 1.2.1 is applied across all deployments and verify that container runtime security policies are configured to follow the principle of least privilege.