The built‑in /flags service in Apache bRPC allows a remote attacker to modify gflag values at runtime. The bvar and mbvar dump paths were registered with an accept‑any validator, letting an attacker supply any file path. By setting bvar_dump_file or mbvar_dump_file to an attacker‑chosen location and then triggering a dump, the server creates directories and truncates or overwrites files at that path. The dump thread subsequently appends tab names from bvar_dump_tabs, which include unsanitized '..' segments, enabling directory traversal and further file overwrite. Additionally, /pprof accepts an unbounded ?seconds= parameter; a very large value causes the server to hold the CPU or contention profiler for an arbitrarily long time, blocking other requests to /hotspots/cpu or /hotspots/contention.

Apache Software Foundation Apache bRPC deployments using the built‑in service port on any platform. Versions earlier than 1.18.0 contain the bugs; the fixes were introduced in 1.18.0, which removes runtime modification of bvar_dump_file, bvar_dump_tabs, and mbvar_dump_file through /flags and clamps the profiling duration to the -max_profiling_seconds gflag (default 300 seconds).

The vulnerability gives remote actors the same privileges as the server process, so they can create or overwrite arbitrary files, potentially installing malicious code or deleting critical data. Exploitation requires only network access to the built‑in service port; no authentication is needed, making untrusted networks a clear threat vector. While no EPSS score is available and the CVE is not listed in CISA KEV, the lack of data does not mitigate the exploitation potential. Given the impact and ease of attack, a high severity rating would be expected.