CVE-2026-32709 - Vulnerability Analysis

Overview

PX4 autopilot < 1.17.0-rc2 contains a path traversal vulnerability caused by improper validation in MAVLink FTP implementation, letting unauthenticated MAVLink peers read, write, create, delete, and rename arbitrary files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can fully manipulate files on the flight controller filesystem, potentially compromising the system.

Mitigation

Update to version 1.17.0-rc2 or later.

References

• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-fh32-qxj9-x32f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner