PX4 autopilot firmware exposes an unauthenticated path traversal vulnerability in its MAVLink FTP implementation. The flaw allows any MAVLink peer to construct file paths that bypass the intended directory boundaries, enabling the attacker to read, write, create, delete, and rename arbitrary files on the onboard or associated companion‑computer filesystem. This results in full file system compromise, potentially allowing modification of flight parameters, firmware, or injection of malicious code (CWE-22).

The affected vendor is PX4 under the product PX4‑Autopilot. All builds prior to version 1.17.0‑rc2 are susceptible. This includes the 1.17.0‑alpha1, 1.17.0‑beta1 and 1.17.0‑rc1 releases, and any earlier releases. The vulnerability exists on both NuttX and POSIX targets used by PX4.

The CVSS base score is 5.4, indicating a medium impact severity. An EPSS score of less than 1 % signifies a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely over any MAVLink channel without authentication; no user interaction on the target is required, and the attacker can execute arbitrary file operations directly from a controlling device.