Prior to version 4.3.0, the Svc::FileUplink component in the F Prime framework did not canonicalize or restrict the destination path specified in an Fw::FilePacket::StartPacket. An attacker controlling the packet can supply an arbitrary, absolute, or traversing path, enabling creation or overwriting of writable files on the host filesystem. This flaw permits integrity compromise and potentially disrupts availability, as critical system files can be altered or replaced. The weakness is a classic file‑system traversal and arbitrary file overwrite vulnerability, reflected by CWE-22 and CWE-73.

The vulnerability affects Nasa fprime installations running any version prior to 4.3.0. Users deploying the framework in spaceflight or embedded environments where external peers may send file‑uplink commands are exposed. The issue was addressed in the 4.3.0 release, which introduced proper path validation and confinement.

The CVSS score of 7.1 indicates significant severity, and the EPSS score of less than 1% indicates a very low likelihood of publicly available exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a remote or networked peer able to craft and transmit a file‑uplink packet. If an attacker can gain control of the packet source, they can overwrite arbitrary files, leading to system compromise or denial of service.