socfortress CoPilot, CVE-2026-61738: a new CVE scored 10

The short version

socfortress CoPilot (CVE-2026-61738) is a new CVE record, published by GitHub on 30 October 2026, with a base score of 10 (CVSS 3.1). We picked it for our daily highlight on 31 October 2026.

It is not on CISA's list of exploited vulnerabilities when we read it, which means nothing public says yet that anyone is using it. A high score is the record's author describing the worst case. Read the conditions before you act on the number.

Free analysis report · 8 pagessocfortress CoPilot, CVE-2026-61738: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

Our reading

In SOCFortress CoPilot, the GCP report upload route builds the save path from the file name in the request. A crafted name makes the server write the uploaded JSON outside the report folder, including into the application's own source folder.

Anyone running an affected CoPilot version, most of all where the backend runs as root and admin or analyst accounts are given to people outside a small trusted team.

Why it matters

Our reading is that the score of 10 rests on a vector that lists no privileges required, while the description says the route admits admin and analyst users. The record does not settle that mismatch. A root-running backend that can overwrite files in its own source directory could have its code changed. The record does not say that was done. CoPilot sits next to your security data, so a write like this is worth closing quickly.

What the record says

The CVE record says:

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. …

What the vendor's advisory says

We read one page on github.com. In short:

• The advisory page lists three weaknesses for this flaw: CWE-22 (path traversal), CWE-73 (external control of a file name or path) and CWE-434 (unrestricted upload of a dangerous file type).
• The advisory page gives a CVSS 3.1 vector of network access, low complexity, no privileges, no user interaction and a changed scope, with high impact on confidentiality, integrity and availability.
• The record says the flaw is in the code before 0.1.77. The text we have lists no other flaws, workarounds or release notes.

Are you affected?

The record lists these versions of socfortress CoPilot as affected:

• < 0.1.77

If you run it, find the version number first. If you cannot say what you run, that is the first job, and your IT provider can answer it in minutes.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It scores 10, so anyone on the internet can take over the host." The description says the route admits admin and analyst users. The vector says no privileges. The record does not reconcile them, so treat the score as a ceiling.
• "It only writes a JSON file, so the harm is small." The record says the write lands outside the report directory, including in the application source directory, and the backend ran as root in the reported case.
• "It is not on CISA's list, so nobody is using it." The record is new. Not being listed when read means CISA has not listed it. It does not show that nobody is trying it.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the CoPilot version you run

• The record says versions before 0.1.77 are affected, so you need the exact version of every CoPilot backend you run.
• Check test and old copies too, not only the production one.

docker compose ps
docker images
git describe --tags

Step 2: Reduce who can reach it

• The route needs an admin or analyst login according to the description, so check who holds those accounts and remove any you do not recognise.
• Keep CoPilot off the open internet until it is updated.

Step 3: Update to the fixed version

• The record names 0.1.77 as the first version with the fix. Update to it or later.
• Run the backend without root if your set-up allows it, since the record says the demonstrated writes were root-owned.

Step 4: Check for files that should not be there

• Look in the application source directory for files changed or added since you last updated.
• Compare them against a clean copy of the version you run.

If it is in range and you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Read the version from the product itself, not from an old inventory, and save the output with the date, so you can show later when it was done.

The weakness behind it

The record classes this as CWE-22 and CWE-73 and CWE-434.

• CWE-22 →What this kind of mistake is, and which exploited vulnerabilities share it.

What we do not know yet

• Whether the flaw can be used without a login. The description names admin and analyst users, but the vector lists none required.
• Whether anyone has used it against a real system. The record only says a researcher showed root-owned writes.
• What exactly the final line of the description says about host-file overwrite. Our copy of it is cut short.
• Whether a workaround exists for those who cannot update. The text we have gives none.
• This is a new record. We read the vendor pages named above, and nothing here has been tested.
• Scores, versions and wording can change in the first days. They are as at 31 October 2026.
• Exploitation is not recorded. That is not the same as none.
• The sections headed "Our reading", "Why it matters", "Exposure by situation", "Things people will get wrong" and "How we would triage it" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.