CVE-2026-21878 HIGH

CVE-2026-21878: BACnet Stack Improperly Limits Pathnames to a Restricted Directory

Vendor Bacnet-Stack
Product bacnet-stack
Weakness CWE-22 · Path traversal
Published February 13, 2026
Last update February 13, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3.

Key dates

02Disclosure timeline

February 13, 2026 CVE published
February 13, 2026 Record updated