Add CVE-2026-62661 Reachy Mini Bluetooth path traversal advisory

Author: yuvalmo-jfrog

vulnerabilities/the-reachy-mini-bluetooth-command-handler-is-vulnerable-to-arbitrary-root-script-execution-via-path-traversal-cve-2026-62661.md

@@ -0,0 +1,120 @@
+---
+description: CVE-2026-62661, HIGH, The Reachy Mini Bluetooth command handler is vulnerable to Arbitrary Root Script Execution via Path Traversal
+
+title: The Reachy Mini Bluetooth command handler is vulnerable to Arbitrary Root Script Execution via Path Traversal
+
+date_published: "2026-08-25"
+last_updated: "2026-08-25"
+xray_id:
+vul_id: CVE-2026-62661
+cvss: 7.2
+severity: high
+discovered_by: Natan Nehorai
+type: vulnerability
+
+---
+
+## Summary
+
+The Reachy Mini Bluetooth command handler is vulnerable to Arbitrary Root Script Execution via Path Traversal
+
+
+## Component
+
+reachy-mini (Bluetooth command service)
+
+## Affected versions
+
+< 1.10.0
+
+## Description
+
+The Reachy Mini Bluetooth command handler (BluetoothCommandService._handle_command in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py) accepts a CMD_<script> payload after a successful PIN authentication and runs the matching file from the commands/ directory with sudo. The script name is taken from the BLE payload with no sanitization and combined using os.path.join("commands", script_name). On POSIX, if the second argument is an absolute path, os.path.join discards the commands/ prefix entirely, so a payload such as CMD_/tmp/reachy_pwn causes the handler to execute sudo /tmp/reachy_pwn.sh. Relative payloads such as CMD_../attacker/pwn likewise escape the intended directory. An attacker who can place a .sh file on the filesystem — for example via the unrestricted media-sounds upload (CVE-2026-55419) — can therefore run that script as root.
+
+This issue is the third step in a documented compromise chain: unrestricted file upload, Bluetooth authentication bypass, then this directory traversal. The published CVSS score (7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects authenticated Bluetooth access.
+
+## PoC
+
+<br>
+
+**Step 1 - Confirm the os.path.join bypass**
+
+<br>
+
+```
+python3 -c "import os; print(os.path.join('commands', '/tmp/reachy_pwn.sh'))"
+```
+
+<br>
+
+Expected output:
+
+```
+/tmp/reachy_pwn.sh
+```
+
+<br>
+
+The first argument is discarded because the second argument is an absolute path.
+
+<br>
+
+**Step 2 - Authenticate on the Bluetooth command characteristic**
+
+<br>
+
+From a BLE client (nRF Connect, Web Bluetooth, or the Reachy Mini control app), write the robot PIN as:
+
+```
+PIN_<last_5_digits_of_serial>
+```
+
+<br>
+
+Expected response:
+
+```
+OK: Connected
+```
+
+<br>
+
+**Step 3 - Send an absolute CMD_ payload**
+
+<br>
+
+The handler appends `.sh` to whatever follows `CMD_`. After authentication, write:
+
+```
+CMD_/tmp/reachy_pwn
+```
+
+<br>
+
+On a vulnerable build this resolves to `sudo /tmp/reachy_pwn.sh` instead of a file under `commands/`. The same escape works with a relative payload such as `CMD_../attacker/pwn`.
+
+<br>
+
+**Step 4 - Confirm with the vendor regression test**
+
+<br>
+
+On a Linux checkout of reachy_mini 1.10.0 or later:
+
+```
+pytest tests/unit_tests/test_ble_path_traversal.py -v
+```
+
+<br>
+
+Those tests assert that the handler never invokes sudo on a path outside `commands/`. They fail against unpatched trees (PATH TRAVERSAL: handler invoked sudo ...) and pass once the command name is constrained to a bare `[A-Za-z0-9_-]+` filename.
+
+## Vulnerability Mitigations
+
+Upgrade to reachy-mini 1.10.0 or later. The fix takes only the final slash-separated component of the client-supplied command name and allow-lists `[A-Za-z0-9_-]` before joining it into `commands/` (https://github.com/pollen-robotics/reachy_mini/commit/caed7d88cd5190c8789cfa4f7d8e34c48ccb14d9). Until then, restrict Bluetooth pairing to trusted devices and do not leave attacker-writable `.sh` files on the robot filesystem.
+
+## References
+https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-vg3x-4hxm-3gxm
+https://github.com/pollen-robotics/reachy_mini/commit/caed7d88cd5190c8789cfa4f7d8e34c48ccb14d9
+https://github.com/pollen-robotics/reachy_mini/releases/tag/v1.10.0
+https://nvd.nist.gov/vuln/detail/CVE-2026-62661