ABC PRO EAP Legislator software contains a path traversal vulnerability (CVE-2026-1186)…
ABC PRO EAP Legislator software contains a path traversal vulnerability (CVE-2026-1186) allowing attackers to extract malicious files to arbitrary system locations via crafted zipx archives.
CERT Polska coordinated the disclosure of CVE-2026-1186, a path traversal vulnerability in ABC PRO EAP Legislator software. The flaw exists in the application's file extraction functionality and allows an attacker to craft a malicious zipx archive—the default file type used by Legislator—that extracts files to arbitrary paths outside the intended directory. An attacker could leverage this to place malicious files in sensitive locations such as system startup directories, achieving persistence or code execution when the victim opens the specially crafted archive.
The vulnerability was responsibly reported by Marcin Ressel and has been remediated in version 2.25a of the software. Users of ABC PRO EAP Legislator should update to this version immediately to mitigate the risk. The issue represents a classic path traversal attack pattern where insufficient validation of file paths during archive extraction enables directory traversal sequences to escape sandboxed extraction directories.
Organizations using this legislative drafting software should prioritize patching, particularly those in government and legal sectors where the application is commonly deployed. The vulnerability requires user interaction—opening a malicious zipx file—making security awareness training an important complementary control.
Mentioned in this report
Detection guidance
Suspicious File Write to Startup Folder by Archive/Document Handling Application (Legislator Path Traversal)
Detects a process associated with ABC PRO EAP Legislator writing files into the Windows Startup folder, indicative of exploitation of CVE-2026-1186 path traversal during zipx extraction to achieve autostart persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write to Startup Folder by Legislator Process
id: cbdab41f-381b-544b-a90c-73bcc9f21ae9
status: experimental
description: Detects file creation events in the Windows Startup folder where the
writing process is the ABC PRO EAP Legislator application, consistent with exploitation
of CVE-2026-1186 path traversal in zipx archive extraction to plant autostart persistence.
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \\Legislator.exe
- \\EAP Legislator.exe
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\Start Menu\\Startup\\
condition: selection
falsepositives:
- Legitimate software installers that intentionally register startup shortcuts through
the Legislator application update process
level: high
tags:
- attack.t1547.001
- attack.persistence
author: Vorant
Archive Extraction Writing Files Outside Target Directory via Path Traversal Sequences
Detects file creation events containing directory traversal sequences (..\ or ../) in the resulting file path, written by an archive-handling process, indicating exploitation of a path traversal vulnerability such as CVE-2026-1186 during zipx extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Extraction with Path Traversal Sequence Escaping Target Directory
id: c9a30e44-a2ac-5321-a0dc-a42f0c71d26e
status: experimental
description: Detects files being created by an archive extraction utility where the
resulting target path contains directory traversal sequences, indicative of exploitation
of a zip/zipx extraction path traversal vulnerability (e.g. CVE-2026-1186) to place
files outside the intended extraction folder.
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- ..\\
- ../
filter_common:
Image|endswith:
- \\svchost.exe
- \\explorer.exe
condition: selection and not filter_common
falsepositives:
- Development tools or build systems that legitimately reference relative parent paths
during file operations
- Backup or synchronization software that writes files using relative path notation
level: medium
tags:
- attack.t1547
- attack.persistence
author: Vorant
Registry Run Key Modification by Legislator Application Following Archive Extraction
Detects creation or modification of a Run/RunOnce autostart registry value by the Legislator process, which may indicate abuse of the archive extraction path traversal flaw (CVE-2026-1186) to establish persistence via registry rather than the Startup folder. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Run Key Set by Legislator Process
id: 36523127-baae-547a-98f5-e7d9834a0428
status: experimental
description: Detects an autostart Registry Run/RunOnce key being set by the ABC PRO
EAP Legislator process, which could indicate exploitation of CVE-2026-1186 path
traversal to drop a persistence mechanism via the registry rather than the Startup
folder.
logsource:
category: registry_set
product: windows
detection:
selection:
Image|endswith:
- \\Legislator.exe
- \\EAP Legislator.exe
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
condition: selection
falsepositives:
- Legitimate first-run configuration of the Legislator application that legitimately
registers an update checker or license reminder in Run keys
level: medium
tags:
- attack.t1547.001
- attack.persistence
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1186
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free