CVE-2026-78299 PUBLISHED

Assigner: eclipse
Reserved: 24.08.2026 Published: 14.09.2026 Updated: 14.09.2026

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

Product Status

Vendor	Eclipse Foundation
Product	Eclipse Embedded CDT (C/C++ Development Tools)
Versions	Default: unaffected unknown from 0 to 6.0.0 (excl.) affected from 6.0.0 to 6.8.0 (excl.)

Credits

Eclipse Foundation Security Team finder

References

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/747
https://github.com/eclipse-embed-cdt/eclipse-plugins/security/advisories/GHSA-qch4-8rmp-mjx3

Problem Types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE