The create_archive function of Rapid7 InsightConnect’s Compression Plugin accepts a filename parameter that is used directly when writing output files. Because the function does not sanitize or validate the supplied path, an attacker can supply a crafted filename that includes directory traversal components and cause the plugin to write to arbitrary locations relative to its working directory. This flaw is a classic file‑system traversal (CWE‑22). The attacker cannot choose the file contents, so the primary harm is corruption or unintended overwrite of existing files rather than injection of malicious payloads.

This vulnerability affects the Rapid7 InsightConnect Compression Plugin when running on Linux operating systems. No specific version ranges are listed, so any installation of the plugin on Linux is potentially vulnerable until a patch is applied.

With a CVSS score of 3.3 the issue is considered low severity. No EPSS data is available and it is not present in the CISA KEV catalog. Exploitation requires an authenticated user capable of invoking create_archive within InsightConnect, which typically means insider or compromised credentials. The impact is limited to file corruption or accidental overwrites, with negligible risk of escalation to remote code execution or system compromise.