The flaw in OpenC3 COSMOS arises from the save_tool_config() function, which permits an attacker to provide a crafted configuration filename and persist the file at any path beneath the shared /plugins directory. The weakness corresponds to CWE-23 (Path Traversal), enabling the creation of arbitrary directory structures and overwriting existing configuration files. This write capability can affect integrity of configuration data but is limited to the plugins tree, making it a low‑to‑moderate risk for systems where the /plugins directory is exposed to untrusted input.

OpenC3 COSMOS versions earlier than 6.10.5 and 7.0.0-rc3 are affected. The issue was fixed in releases 6.10.5 and 7.0.0-rc3. Systems running these or newer versions are not vulnerable.

The CVSS score of 4.3 indicates low severity; no EPSS data is available and the vulnerability is not listed in CISA KEV, suggesting moderate exploitation likelihood. The attack likely requires local access to the application or untrusted input that can invoke save_tool_config(), since the flaw does not provide a remote code execution surface. Nonetheless, it permits modification of critical configuration files within the plugins tree, potentially causing misconfiguration or downgrade of security controls.