CVE-2024-46977: OPENC3 Cosmos

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.

Affected products

• OPENC3 Cosmos: before 5.19.0 (fixed in 5.19.0)

Published 2024-10-02. Last modified 2026-06-17.