Security readout for executives and security teams
Plain-English summary
CVE-2026-27884 affects NetExec before 1.5.1. When its spider_plus module downloads files from SMB shares, specially named files can cause NetExec to write or overwrite files outside the intended output folder. This mainly threatens the system running NetExec, not the SMB server itself.
Executive priority
Treat as a targeted operational tooling risk. Prioritize teams that use NetExec for security testing or administration, especially on privileged workstations or servers. Update is straightforward and should be scheduled promptly, but current public evidence does not support emergency incident response solely for this CVE.
Technical view
The flaw is a CWE-22 path traversal in spider_plus file path creation. Linux SMB shares may contain traversal sequences in filenames. If spider_plus crawls and downloads such content, NetExec can perform arbitrary file write/overwrite. CVSS 3.1 is 5.3: network vector, high complexity, user interaction required, integrity impact high.
Likely exposure
Exposure is likely limited to organizations using NetExec versions earlier than 1.5.1 and running spider_plus with DOWNLOAD=true against SMB shares. Systems where NetExec runs with elevated privileges have greater potential impact from unintended file writes.
Exploitation context
Supplied sources do not show active exploitation, and the CVE is not marked KEV. Exploitation requires a crafted filename on an SMB share and a user or process running spider_plus download behavior against that share. This is more likely in testing, assessment, or internal security operations workflows.
Researcher notes
The advisory names affected versions as prior to 1.5.1 and the workaround as avoiding spider_plus DOWNLOAD=true. The sources do not provide evidence of exploitation in the wild. Analysis should focus on local impact to the NetExec runner and whether downloaded SMB filenames are safely normalized after patching.
Mitigation direction
- Upgrade NetExec to version 1.5.1 or later.
- Do not run spider_plus with DOWNLOAD=true against targets until upgraded.
- Review the GitHub advisory and project release guidance.
- Run NetExec with least privileges where operationally feasible.
Validation and detection
- Inventory NetExec installations and confirm versions are 1.5.1 or later.
- Identify workflows using spider_plus with DOWNLOAD=true.
- Review recent NetExec output locations for unexpected file writes.
- Confirm the patched version includes the referenced fix commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27884 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N1.63.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Pennyw0rth/NetExec/security/advisories/GHSA-fccr-6qm2-7h27CVE reference · x_refsource_CONFIRM
- https://github.com/Pennyw0rth/NetExec/issues/1120CVE reference · x_refsource_MISC
- https://github.com/Pennyw0rth/NetExec/pull/1121CVE reference · x_refsource_MISC
- https://github.com/Pennyw0rth/NetExec/commit/7d027f2774d0520b322d60f9c99b9ab3edb4035eCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.