CVE-2026-9154 - Arbitrary File Write in Rapid7 InsightConnect Sed Plugin

Back Back to CVE browser

HIGH

Arbitrary File Write in Rapid7 InsightConnect Sed Plugin

Published Jun 25, 2026

7.1

HIGH

CVSS 3.1

EPSS 0.41%

Description

Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.

Affected products

Vendor Rapid7 Product InsightConnect Sed Plugin Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.0.5
- Version
  2.0.5
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rapid7

InsightConnect Sed Plugin

unaffected

Version	Status	Constraints
0	affected	<2.0.5
2.0.5	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (1)

https://extensions.rapid7.com/extension/sed
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://extensions.rapid7.com/extension/sed		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner rapid7

Published Jun 25, 2026

Updated Jun 25, 2026

Reserved May 21, 2026

Link CVE-2026-9154

CISA Vulnrichment

Updated Jun 25, 2026

NVD

Status Analyzed

Modified Jun 27, 2026

Link CVE-2026-9154

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9154