Path Traversal in Pennyw0rth Netexec
CVE-2026-27884
NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when saving files from SMB shares. It does not take into account that it is possible for Linux SMB shares to have path traversal characters such as `../` in them. An attacker can craft a filename in an SMB share that includes these characters, which when spider_plus crawls and downloads, can write or overwrite arbitrary files. The issue is patched in v1.5.1. As a workaround, do not run spider_plus with DOWNLOAD=true against targets.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (25.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.
Affected products
- Pennyw0rth Netexec — versions < 1.5.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-27884?
- CVE-2026-27884 is a medium-severity vulnerability in Pennyw0rth Netexec, classified under Path Traversal. CVSS score: 5.3/10. Published 2026-02-26.
- How severe is CVE-2026-27884?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2026-27884 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.