Picturall Media Server Root Escalation Flaw Patched
A path traversal bug in Analog Way Picturall Quad Compact Mark II lets local users escalate to root via a maintenance script; fixed in v3.5.9.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed CVE-2026-14985, a local privilege escalation vulnerability in Analog Way's Picturall Quad Compact Mark II 8K media server, version 3.5.8. The flaw resides in the create_local_installer.sh maintenance script, which is executable by the low-privileged 'picmedia' account as root without a password. By crafting a malicious Ext4 disk image containing a picturall-version.txt file with directory traversal sequences and a payload, an attacker can trick the script into writing arbitrary files outside its intended extraction directory, including into /etc/cron.d, ultimately enabling arbitrary code execution as root.
The vulnerability requires local access to the device but no valid root credentials, making exploitation straightforward and repeatable. CERT/CC rates the technical impact as 'Total' under SSVC, reflecting complete compromise of confidentiality, integrity, and availability of the affected system. This is a serious risk for professional audiovisual environments where these media servers are deployed, particularly if physical or local network access to the device can be obtained by an untrusted party.
Analog Way has released version 3.5.9 to remediate the issue, and CERT/CC urges affected organizations to update promptly. There is no indication of active exploitation in the wild; this is a coordinated disclosure with a vendor-supplied fix already available.
Mentioned in this report
Detection guidance
Picturall Maintenance Script Executed as Root
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of the create_local_installer.sh maintenance script with root privileges, which the CVE abuses because it runs passwordless as root for the low-privileged picmedia account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Picturall Maintenance Script Executed as Root
description: Detects execution of create_local_installer.sh with an effective root
UID/User, which is the entry point for CVE-2026-14985. Legitimate maintenance runs
exist, but any invocation by the low-privileged picmedia account or outside scheduled
maintenance windows warrants review.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /create_local_installer.sh
root_context:
User:
- root
- picmedia
condition: selection and root_context
falsepositives:
- Legitimate vendor-scheduled or IT-driven maintenance/reinstallation of the media
server firmware
level: medium
id: 63b4d592-6e7e-5757-aeb4-f442b97173e5
status: experimental
author: Vorant
Cron.d File Written by Non-Package-Manager Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of files under /etc/cron.d by a process other than the system package manager, matching the exploitation step where a crafted disk image tricks a maintenance script into path-traversal writes into cron.d for root persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cron.d File Written by Non-Package-Manager Process
description: Detects file creation under /etc/cron.d performed by a process that is
not a standard package manager (dpkg/apt/rpm/yum). This generalises the CVE-2026-14985
exploitation step where directory traversal in an extraction routine (e.g. create_local_installer.sh)
writes an attacker file into /etc/cron.d to achieve root code execution via cron.
Not tied to any specific payload filename.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|startswith: /etc/cron.d/
filter_pkg_managers:
Image|endswith:
- /dpkg
- /apt
- /apt-get
- /rpm
- /yum
- /dnf
condition: selection and not filter_pkg_managers
falsepositives:
- Custom configuration management tools (Ansible, Puppet, Chef) that legitimately
drop cron.d files outside the package manager
- Vendor install scripts that intentionally place scheduled maintenance jobs in cron.d
level: high
id: e701f069-2670-521f-90c6-658f381fa09e
status: experimental
author: Vorant
Archive Extraction with Directory Traversal Sequence in Command Line
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects extraction utilities (tar/cpio/mount-based loop extraction) invoked with directory traversal sequences in their arguments, matching the crafted Ext4 image / picturall-version.txt exploitation primitive used to escape the intended extraction directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Extraction with Directory Traversal Sequence in Command Line
description: Detects invocation of archive/image extraction utilities where the command
line or an associated argument contains directory traversal sequences (../), consistent
with the CVE-2026-14985 technique of crafting a malicious disk image entry (picturall-version.txt)
to escape the intended extraction directory and write files elsewhere on disk.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /tar
- /cpio
- /mount
- /unsquashfs
CommandLine|contains: ../
condition: selection
falsepositives:
- Legitimate backup/restore or firmware update tooling that intentionally uses relative
paths during extraction
- Developer or QA testing of archive handling code
level: medium
id: 96525b61-a4ee-543c-aa6b-3e36d0fbc528
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/360868
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs