CVE-2026-0804 — Path Traversal

title: ACAP Application Installation with Path Traversal Attempt — CVE-2026-0804
id: scw-2026-05-12-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to create or modify sensitive system files like /etc/passwd or /etc/shadow, or files using directory traversal sequences ('../') within the context of ACAP application installations. This is a specific indicator for the path traversal vulnerability (CVE-2026-0804) where an attacker might try to access or manipulate critical system files through a malicious ACAP application.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-0804/
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|startswith:
          - '/etc/passwd'
          - '/etc/shadow'
          - '../'
      EventType: 'creation'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse