# Picturall Media Server Root Escalation Flaw Patched

Published: 2026-07-22 · Severity: medium · Sectors: media
Canonical: https://vorant.io/reports/59ee925c-c62f-52bb-94c6-4441c7bb5273/picturall-media-server-root-escalation-flaw-patched

> A path traversal bug in Analog Way Picturall Quad Compact Mark II lets local users escalate to root via a maintenance script; fixed in v3.5.9.

CERT/CC disclosed CVE-2026-14985, a local privilege escalation vulnerability in Analog Way's Picturall Quad Compact Mark II 8K media server, version 3.5.8. The flaw resides in the create_local_installer.sh maintenance script, which is executable by the low-privileged 'picmedia' account as root without a password. By crafting a malicious Ext4 disk image containing a picturall-version.txt file with directory traversal sequences and a payload, an attacker can trick the script into writing arbitrary files outside its intended extraction directory, including into /etc/cron.d, ultimately enabling arbitrary code execution as root.

The vulnerability requires local access to the device but no valid root credentials, making exploitation straightforward and repeatable. CERT/CC rates the technical impact as 'Total' under SSVC, reflecting complete compromise of confidentiality, integrity, and availability of the affected system. This is a serious risk for professional audiovisual environments where these media servers are deployed, particularly if physical or local network access to the device can be obtained by an untrusted party.

Analog Way has released version 3.5.9 to remediate the issue, and CERT/CC urges affected organizations to update promptly. There is no indication of active exploitation in the wild; this is a coordinated disclosure with a vendor-supplied fix already available.

## Mentioned in this report

- Vulnerabilities: CVE-2026-14985

## Detection guidance (public sample)

### Picturall Maintenance Script Executed as Root

ATT&CK: T1068

Detects execution of the create_local_installer.sh maintenance script with root privileges, which the CVE abuses because it runs passwordless as root for the low-privileged picmedia account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Picturall Maintenance Script Executed as Root
description: Detects execution of create_local_installer.sh with an effective root
  UID/User, which is the entry point for CVE-2026-14985. Legitimate maintenance runs
  exist, but any invocation by the low-privileged picmedia account or outside scheduled
  maintenance windows warrants review.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /create_local_installer.sh
  root_context:
    User:
    - root
    - picmedia
  condition: selection and root_context
falsepositives:
- Legitimate vendor-scheduled or IT-driven maintenance/reinstallation of the media
  server firmware
level: medium
id: 63b4d592-6e7e-5757-aeb4-f442b97173e5
status: experimental
author: Vorant
```

### Cron.d File Written by Non-Package-Manager Process

ATT&CK: T1574

Detects creation of files under /etc/cron.d by a process other than the system package manager, matching the exploitation step where a crafted disk image tricks a maintenance script into path-traversal writes into cron.d for root persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cron.d File Written by Non-Package-Manager Process
description: Detects file creation under /etc/cron.d performed by a process that is
  not a standard package manager (dpkg/apt/rpm/yum). This generalises the CVE-2026-14985
  exploitation step where directory traversal in an extraction routine (e.g. create_local_installer.sh)
  writes an attacker file into /etc/cron.d to achieve root code execution via cron.
  Not tied to any specific payload filename.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith: /etc/cron.d/
  filter_pkg_managers:
    Image|endswith:
    - /dpkg
    - /apt
    - /apt-get
    - /rpm
    - /yum
    - /dnf
  condition: selection and not filter_pkg_managers
falsepositives:
- Custom configuration management tools (Ansible, Puppet, Chef) that legitimately
  drop cron.d files outside the package manager
- Vendor install scripts that intentionally place scheduled maintenance jobs in cron.d
level: high
id: e701f069-2670-521f-90c6-658f381fa09e
status: experimental
author: Vorant
```

### Archive Extraction with Directory Traversal Sequence in Command Line

ATT&CK: T1574

Detects extraction utilities (tar/cpio/mount-based loop extraction) invoked with directory traversal sequences in their arguments, matching the crafted Ext4 image / picturall-version.txt exploitation primitive used to escape the intended extraction directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Archive Extraction with Directory Traversal Sequence in Command Line
description: Detects invocation of archive/image extraction utilities where the command
  line or an associated argument contains directory traversal sequences (../), consistent
  with the CVE-2026-14985 technique of crafting a malicious disk image entry (picturall-version.txt)
  to escape the intended extraction directory and write files elsewhere on disk.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /tar
    - /cpio
    - /mount
    - /unsquashfs
    CommandLine|contains: ../
  condition: selection
falsepositives:
- Legitimate backup/restore or firmware update tooling that intentionally uses relative
  paths during extraction
- Developer or QA testing of archive handling code
level: medium
id: 96525b61-a4ee-543c-aa6b-3e36d0fbc528
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/360868

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/59ee925c-c62f-52bb-94c6-4441c7bb5273/picturall-media-server-root-escalation-flaw-patched.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup