CVE-2026-41551: Path Traversal in file_server get_file() - Siemens ROS#

May 12, 2026

Details

Description

A relative path traversal vulnerability (CWE-23) exists in the ROS# file_server service. The get_file() function constructs a file path by concatenating the user-controlled package and filepath components of the service request without sanitization or normalization. By supplying ../ sequences in the request name, an attacker can traverse out of the package directory and read or write arbitrary files on the filesystem with the privileges of the service user.

The vulnerable code resolves the package directory and then appends the attacker-controlled remainder of the path directly:

// ROS2 (file_server2/src/file_server.cpp)
std::string address = request->name.substr(10);
std::string package = address.substr(0, address.find("/"));
std::string filepath = address.substr(package.length());
std::string directory = ament_index_cpp::get_package_share_directory(package);
directory += filepath;   // no normalization — "../" escapes the package directory

The ROS1 implementation (file_server/src/file_server.cpp) is affected in the same way, using ros::package::getPath(package) before the unchecked concatenation.

Attack Vectors

An attacker who can reach the file_server service (for example via a rosbridge_server WebSocket exposed to an untrusted network) sends a get_file request whose name contains directory-traversal sequences such as package://file_server2/../../../../../../etc/passwd. The service returns the contents of the targeted file. Because the package documents file_server use for URDF transfers, robot-model visualization, and Gazebo/Unity simulation scenes, deployments that expose these services to untrusted networks are remotely exploitable. The Siemens advisory characterizes the impact as read and write access to arbitrary files with the service user’s privileges.

References