CVE-2026-9154

Summary dbcve.org

Arbitrary File Write vulnerability in the Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths by manipulating the expression parameter, potentially leading to code execution or system compromise.

Mitigation

Implement strict input validation and path sanitization on the expression parameter to prevent path traversal and restrict write operations to intended directories; also apply principle of least privilege to plugin permissions.