BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary directories. This affects apps/readfile/main.c and ports/posix/bacfile-posix.c. This vulnerability is fixed in 1.5.0.rc3.
References
| Link | Resource |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/commit/c5dc00a77b4bc2550befa67a930b333e299c18f3 | Patch |
| https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j | Vendor Advisory Exploit |
Configurations
Configuration 1 (hide)
|
History
18 Feb 2026, 18:49
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:* cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:* |
|
| References | () https://github.com/bacnet-stack/bacnet-stack/commit/c5dc00a77b4bc2550befa67a930b333e299c18f3 - Patch | |
| References | () https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j - Vendor Advisory, Exploit | |
| First Time |
Bacnetstack bacnet Stack
Bacnetstack |
13 Feb 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-13 19:17
Updated : 2026-02-18 18:49
NVD link : CVE-2026-21878
Mitre link : CVE-2026-21878
CVE.ORG link : CVE-2026-21878
JSON object : View
Products Affected
bacnetstack
- bacnet_stack
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')