CVE-2026-29205

Executive Summary

CVE-2026-29205 is a high-severity arbitrary file read vulnerability affecting the cpdavd attachment download endpoints of an unknown product attributed to "hackerone." The flaw combines incorrect privilege management with insufficient path filtering (CWE-250), allowing an unauthenticated or low-privileged attacker to traverse the filesystem and read arbitrary files from the server. With a CVSS score of 8.6 and an EPSS score placing it in the 93.7th percentile of exploited vulnerabilities, this flaw represents a significant risk for exposed instances. No patch is currently available, and the vendor has not issued a fix or workaround, making immediate network segmentation and access controls critical.

Technical Analysis

The vulnerability resides in the cpdavd daemon, which is likely a WebDAV (HTTP/Web Distributed Authoring and Versioning) service component handling attachment downloads. The NVD description identifies two distinct weaknesses that compound to create the arbitrary file read:

1. Incorrect Privilege Management (CWE-250): The cpdavd process executes with elevated privileges but fails to properly drop or restrict those privileges when handling attachment download requests. This means any file accessible by the daemon's effective user (which may include system files, configuration files, or other sensitive data) becomes readable through this endpoint.

2. Insufficient Path Filtering: The attachment download endpoints accept a file path or reference parameter but do not adequately validate or sanitize the input. Path traversal sequences such as ../, absolute paths, or encoded variants (%2e%2e%2f) are not filtered, allowing an attacker to escape the intended attachment directory and reference arbitrary files on the server's filesystem.

Attack Surface: The vulnerability is exploitable over the network via HTTP requests to the cpdavd attachment download endpoint. If the service is bound to a public interface (port 80, 443, or a custom WebDAV port such as 8080), any remote attacker can exploit this without prior authentication (depending on the privilege management issue, authentication may be required but a low-privilege account would suffice).

Code-Level Explanation (based on the vulnerability class): The likely vulnerable code pattern is similar to the following pseudo-code:

function handle_download(attachment_id):
    path = base_dir + attachment_id  # user-controlled input
    if not is_valid_path(path):       # insufficient filtering
        return error
    return send_file(path)            # runs with elevated privileges

The is_valid_path check may only verify the presence of .. in the raw string but misses URL-encoded traversal (%2e%2e%2f) or absolute path references (/etc/passwd). Additionally, the daemon fails to use os.chroot() or privilege drop mechanisms (setuid, setgid) after binding to the network port, maintaining root or service-account access throughout request handling.

The EPSS score of 0.07244 (93.7th percentile) indicates that this vulnerability is statistically likely to be exploited in the wild, even without a public PoC, likely due to the simplicity of path traversal attacks.

Exploitation Scenarios

Even without a public PoC, the attack chain for this vulnerability follows standard path traversal techniques:

1) Reconnaissance and Target Identification

• An attacker scans the internet for exposed cpdavd services using Shodan/Censys with dorks such as http.title:"cpdavd" or product:"cpdavd".
• Alternatively, port scans reveal open WebDAV ports (TCP 80, 443, 8080, 8443) on target ranges.
• The attacker fingerprints the service by sending an OPTIONS request to root; a WebDAV server responds with DAV: headers in the Allow field.

2) Trigger and Weaponization

• The attacker identifies the attachment download endpoint, commonly at paths like /attachments/download?file=, /cpdavd/attachment?path=, or /download/{filename}.
• The attacker crafts malicious requests using various traversal payloads:
  • GET /attachments/download?file=../../../../etc/passwd
  • GET /cpdavd/attachment?path=..%2f..%2f..%2fetc%2fshadow
  • GET /download/..%252f..%252f..%252fetc%252fpasswd (double URL encoding to bypass naive filters)
  • Directory traversal with absolute paths: GET /cpdavd/attachment?path=/etc/passwd

3) Payload/Execution

• The attacker sends the crafted GET request. The cpdavd daemon, running with elevated privileges and lacking path validation, resolves the traversal path outside the attachment directory.
• The server responds with HTTP 200 and the contents of the requested file (e.g., /etc/passwd, /etc/shadow, application configuration files containing secrets, or SSL private keys).

4) Post-Exploitation Impact

• Harvested credentials (from /etc/shadow or database config files) enable further lateral movement.
• Reading TLS private keys permits man-in-the-middle attacks or impersonation of the affected server.
• If source code files (e.g., .php, .asp, .py) are readable, the attacker discovers additional application vulnerabilities and hardcoded secrets.
• The attacker may chain this file read with other known vulnerabilities (e.g., log poisoning to achieve RCE via reading web server logs combined with LFI).

Impact Assessment

• CVSS Subscore Context: With an overall score of 8.6 (High severity), the attack vector is likely network-based (AV:N), with low attack complexity (AC:L) given that only a crafted URL is required. The confidentiality impact is HIGH, while integrity and availability impacts are likely LOW or NONE (since this is a read-only vulnerability).
• Business Impact: Sensitive data disclosure including user credentials, encryption keys, business documents, and proprietary source code. In regulated environments, this constitutes a reportable data breach.
• Affected Systems: Any server running the cpdavd service, particularly those exposed to untrusted networks. The vendor "hackerone" suggests this may be part of a security testing platform or a tool used by bug bounty programs, meaning affected deployments could include internal infrastructure or SaaS platforms.
• Blast Radius: Full filesystem read with elevated privileges means an attacker can potentially access the entire server disk, not just the application's data directory. This elevates the impact from a localized vulnerability to a full system compromise vector.

Detection Guidance

Sigma Rule

title: CVE-2026-29205 - Arbitrary File Read via cpdavd Attachment Endpoint
id: 7f3e2a1c-9d4b-4e1a-8c2f-2b5d6a1e3c9f
status: experimental
description: Detects path traversal attempts against cpdavd attachment download endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29205
author: Valtersit Threat Intelligence
date: 2026/02/15
tags:
    - attack.t1190
    - cve.2026.29205
    - cwe.250
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for cpdavd service'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/attachments/download?file='
            - '/cpdavd/attachment?path='
            - '/attachment/download/'
        cs-uri-query|re:
            - '\.\./'
            - '%2e%2e%2f'
            - '%252e%252e%252f'
            - '(?i)(etc/passwd|etc/shadow|\.ssh/|id_rsa|\.env|web\.config)'
    condition: selection
falsepositives:
    - Legitimate file operations in incorrectly configured applications
    - URL decoding by proxies normalizing traversal characters
level: high

YARA Rule

rule CVE_2026_29205_cpdavd_path_traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal payloads targeting cpdavd attachment endpoints"
        date = "2026-02-15"
        cve = "CVE-2026-29205"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-29205"
    strings:
        $endpoint1 = "/attachments/download?file=" ascii wide nocase
        $endpoint2 = "/cpdavd/attachment?path=" ascii wide nocase
        $endpoint3 = "/attachment/download/" ascii wide nocase
        $traversal1 = "..%2f" ascii wide nocase
        $traversal2 = "..%5c" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide
        $traversal4 = "%252e%252e%252f" ascii wide
        $traversal5 = "..//..//" ascii wide
        $sensitive1 = "/etc/shadow" ascii wide
        $sensitive2 = "/etc/passwd" ascii wide
        $sensitive3 = ".ssh/id_rsa" ascii wide
        $sensitive4 = "boot.ini" ascii wide
        $sensitive5 = "web.config" ascii wide
    condition:
        any of ($endpoint*) and any of ($traversal* or $sensitive*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-29205 - cpdavd Attachment Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/attachments/download"; http.uri; content:"?"; http.uri; pcre:"/(file|path)=[^&]*(\.\.[\/\\]|%2e%2e[\/\\]|%252e%252e[\/\\]|(%2f|\/)etc[\/\\](passwd|shadow)|(%2f|\/)\.ssh[\/\\]id_rsa|boot\.ini|web\.config)/i"; classtype:attempted-recon; sid:2026292051; rev:1; reference:cve,2026-29205;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-29205 - cpdavd Sensitive File Read"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(etc[\/\\](passwd|shadow|group)|\.ssh[\/\\]id_rsa|\.env|config\.php|web\.config|proc[\/\\]self[\/\\]environ)/i"; http.uri; content:"/attachment"; http.uri; content:"/download"; classtype:attempted-information-leak; sid:2026292052; rev:1; reference:cve,2026-29205;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.direction == "ingress" and destination.port == 80 or destination.port == 443]
  [http where http.request.method == "GET" and 
   (lower(http.request.uri) like "*attachments/download*" or 
    lower(http.request.uri) like "*cpdavd/attachment*" or 
    lower(http.request.uri) like "*attachment/download*") and
   (lower(http.request.uri) like "*../*" or 
    lower(http.request.uri) like "*..%2f*" or 
    lower(http.request.uri) like "*%2e%2e*" or
    lower(http.request.uri) like "*etc/passwd*" or
    lower(http.request.uri) like "*etc/shadow*" or
    lower(http.request.uri) like "*id_rsa*")]

Splunk SPL Query

index=web sourcetype=access_combined 
  (uri_path="/attachments/download*" OR uri_path="/cpdavd/attachment*" OR uri_path="/attachment/download*")
  OR (uri_query LIKE "%..%2f%" OR uri_query LIKE "%..%5c%" OR uri_query LIKE "%..%252f%" OR uri_query LIKE "%etc%2fpasswd%" OR uri_query LIKE "%etc%2fshadow%")
  OR (uri LIKE "%/etc/passwd%" OR uri LIKE "%/etc/shadow%" OR uri LIKE "%.ssh%id_rsa%" OR uri LIKE "%web.config%")
  | stats count by src_ip, uri, http_user_agent, status
  | sort - count
  | where count >= 3 OR src_ip NOT IN [lookup known_good_sources.csv]

Wazuh OSSEC Rule

<rule id="100292" level="12" frequency="5" timeframe="60">
  <if_sid>31100</if_sid>
  <match>cpdavd|/attachments/download|/attachment/download</match>
  <regex>(\.\./|\.\.\\\\|%2e%2e%2f|%252e%252e%252f)</regex>
  <regex>(/etc/passwd|/etc/shadow|/etc/group|\.ssh/id_rsa|\.env|web\.config|boot\.ini)</regex>
  <description>CVE-2026-29205: Multiple path traversal attempts against cpdavd attachment endpoint</description>
  <group>web_application_attack,path_traversal,cve_2026_29205,</group>
</rule>

<rule id="100293" level="12">
  <if_sid>31100</if_sid>
  <match>cpdavd</match>
  <regex>(/etc/passwd|/etc/shadow|/etc/group|\.ssh/id_rsa)</regex>
  <description>CVE-2026-29205: cpdavd arbitrary file read - sensitive file accessed</description>
  <group>web_application_attack,information_disclosure,cve_2026_29205,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. The vendor has not issued a fix. No patched version exists.

1. Immediate Mitigations (interim until vendor patch):

   • Restrict network access to the cpdavd service: place it behind a firewall and allow only trusted IPs. Use network segmentation to isolate it from the internet.
   • If the service does not need external access, disable or firewall the attachment download endpoints entirely.
   • Deploy a WAF (Web Application Firewall) rule to block requests containing path traversal patterns (../, ..%2f, %2e%2e%2f, %252e, absolute paths to sensitive files) toward the identified endpoints.
   • Monitor logs immediately for exploitation attempts using the detection rules above; treat any hits as a potential breach requiring incident response.

2. Patch/Upgrade Steps:

   • Subscribe to the vendor's security advisory feed (hackerone) for CVE-2026-29205 notifications.
   • When a patched version is released, upgrade immediately. Validate the patched daemon correctly drops privileges (setuid/setgid to an unprivileged user) and performs canonical path validation using realpath() before serving files.
   • If this is a managed vendor platform, contact the vendor's support team to request an ETA for the fix and inquire about temporary hotfixes.

3. Long-Term Hardening:

   • Run the cpdavd daemon under a dedicated unprivileged service account with least privilege; it should never run as root.
   • Use OS-level sandboxing (e.g., chroot, systemd ProtectSystem/ProtectHome, or container isolation) to limit filesystem visibility.
   • Implement application-level input validation: reject any request that is not a simple alphanumeric attachment ID, resolve all paths with realpath(), and verify the canonical path is within the attachment directory before opening.
   • Consider FUSE-based virtual filesystem or object storage (e.g., S3) for attachment storage to separate application storage from the OS filesystem.
   • Maintain a vulnerability management program that tracks the EPSS percentile (93.7% here) to prioritize remediation.

References

1. NVD Entry - https://nvd.nist.gov/vuln/detail/CVE-2026-29205
2. CWE-250 - https://cwe.mitre.org/data/definitions/250.html (Incorrect Privilege Assignment)
3. MITRE ATT&CK - https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)
4. OWASP Path Traversal - https://owasp.org/www-community/attacks/Path_Traversal
5. FIRST EPSS - https://www.first.org/epss/ (Refer to EPSS data for CVE-2026-29205)

Threat Actor Campaigns: As of this report, there is no public CISA KEV listing and no confirmed exploit-in-the-wild campaigns attributed to a named threat actor group. However, the high EPSS percentile signals active scanning or exploitation attempts are statistically likely. Security teams should treat any externally exposed instance as immediately compromised until logs are reviewed.