ABC PRO EAP Legislator path traversal enables arbitrary file extraction
ABC PRO EAP Legislator software contains a path traversal vulnerability (CVE-2026-1186) allowing attackers to extract malicious files to arbitrary system locations via crafted zipx archives.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-1186, a path traversal vulnerability in ABC PRO EAP Legislator software. The flaw exists in the application's file extraction functionality and allows an attacker to craft a malicious zipx archive—the default file type used by Legislator—that extracts files to arbitrary paths outside the intended directory. An attacker could leverage this to place malicious files in sensitive locations such as system startup directories, achieving persistence or code execution when the victim opens the specially crafted archive.
The vulnerability was responsibly reported by Marcin Ressel and has been remediated in version 2.25a of the software. Users of ABC PRO EAP Legislator should update to this version immediately to mitigate the risk. The issue represents a classic path traversal attack pattern where insufficient validation of file paths during archive extraction enables directory traversal sequences to escape sandboxed extraction directories.
Organizations using this legislative drafting software should prioritize patching, particularly those in government and legal sectors where the application is commonly deployed. The vulnerability requires user interaction—opening a malicious zipx file—making security awareness training an important complementary control.
Mentioned in this report
Detection guidance
Suspicious File Write to Startup Folder by Archive/Document Handling Application (Legislator Path Traversal)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process associated with ABC PRO EAP Legislator writing files into the Windows Startup folder, indicative of exploitation of CVE-2026-1186 path traversal during zipx extraction to achieve autostart persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write to Startup Folder by Legislator Process
id: cbdab41f-381b-544b-a90c-73bcc9f21ae9
status: experimental
description: Detects file creation events in the Windows Startup folder where the
writing process is the ABC PRO EAP Legislator application, consistent with exploitation
of CVE-2026-1186 path traversal in zipx archive extraction to plant autostart persistence.
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\Legislator.exe
- \\EAP Legislator.exe
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\Start Menu\\Startup\\
condition: selection
falsepositives:
- Legitimate software installers that intentionally register startup shortcuts through
the Legislator application update process
level: high
tags:
- attack.t1547.001
- attack.persistence
author: Vorant
Archive Extraction Writing Files Outside Target Directory via Path Traversal Sequences
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file creation events containing directory traversal sequences (..\ or ../) in the resulting file path, written by an archive-handling process, indicating exploitation of a path traversal vulnerability such as CVE-2026-1186 during zipx extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Extraction with Path Traversal Sequence Escaping Target Directory
id: c9a30e44-a2ac-5321-a0dc-a42f0c71d26e
status: experimental
description: Detects files being created by an archive extraction utility where the
resulting target path contains directory traversal sequences, indicative of exploitation
of a zip/zipx extraction path traversal vulnerability (e.g. CVE-2026-1186) to place
files outside the intended extraction folder.
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- ..\\
- ../
filter_common:
Image|endswith:
- \\svchost.exe
- \\explorer.exe
condition: selection and not filter_common
falsepositives:
- Development tools or build systems that legitimately reference relative parent paths
during file operations
- Backup or synchronization software that writes files using relative path notation
level: medium
tags:
- attack.t1547
- attack.persistence
author: Vorant
Registry Run Key Modification by Legislator Application Following Archive Extraction
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation or modification of a Run/RunOnce autostart registry value by the Legislator process, which may indicate abuse of the archive extraction path traversal flaw (CVE-2026-1186) to establish persistence via registry rather than the Startup folder. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Run Key Set by Legislator Process
id: 36523127-baae-547a-98f5-e7d9834a0428
status: experimental
description: Detects an autostart Registry Run/RunOnce key being set by the ABC PRO
EAP Legislator process, which could indicate exploitation of CVE-2026-1186 path
traversal to drop a persistence mechanism via the registry rather than the Startup
folder.
logsource:
category: registry_set
product: windows
detection:
selection:
Image|endswith:
- \\Legislator.exe
- \\EAP Legislator.exe
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
condition: selection
falsepositives:
- Legitimate first-run configuration of the Legislator application that legitimately
registers an update checker or license reminder in Run keys
level: medium
tags:
- attack.t1547.001
- attack.persistence
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1186
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs