ABC PRO EAP Legislator path traversal flaw
A path traversal vulnerability in ABC PRO EAP Legislator allows attackers to extract malicious files to arbitrary system locations via crafted zipx archives.
CERT Polska coordinated the disclosure of CVE-2026-1186, a path traversal vulnerability in ABC PRO EAP Legislator software. The flaw exists in the application's file extraction functionality, where specially crafted zipx archives—the default file type used by Legislator—can extract files to arbitrary paths outside the intended directory, including sensitive system locations such as the startup directory. An attacker exploiting this vulnerability would need to deliver a malicious zipx file to a victim and convince them to open it with the vulnerable application.
The vulnerability was responsibly reported by researcher Marcin Ressel and has been addressed by the vendor in version 2.25a. Organizations using ABC PRO EAP Legislator should update to the patched version to mitigate the risk of arbitrary file write attacks that could lead to code execution or system compromise.
This disclosure follows CERT Polska's coordinated vulnerability disclosure process, demonstrating effective collaboration between security researchers, coordination bodies, and vendors to address security issues before they can be widely exploited.
Mentioned in this report
Detection guidance
File Written to Startup Folder by ABC PRO EAP Legislator (Possible CVE-2026-1186 Exploitation)
Detects Legislator archive extraction writing files into the Windows Startup folder, indicating path traversal exploitation of CVE-2026-1186 via a malicious zipx archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Written to Startup Folder by ABC PRO EAP Legislator
id: 1c59305d-54a7-562e-a718-f60ee4258d15
status: experimental
description: Detects files being written to the Startup folder by the ABC PRO EAP
Legislator application, which may indicate exploitation of the CVE-2026-1186 path
traversal vulnerability during zipx archive extraction, resulting in persistence
via the Startup directory.
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- Legislator
- EAP Legislator
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
condition: selection
falsepositives:
- Legitimate use of Legislator to install shortcuts or add-ins intended for the Startup
folder (rare and should be verified)
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
Registry Run Key Set by ABC PRO EAP Legislator Process
Detects a Run/RunOnce registry value being created by the Legislator application process, consistent with abuse of the CVE-2026-1186 path traversal flaw to achieve persistence outside normal extraction directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Registry Run Key Created by ABC PRO EAP Legislator
id: c076b58a-606a-5770-b63b-ba473adf0d29
status: experimental
description: Detects the Legislator application writing to Run/RunOnce registry keys,
which is unexpected behavior for a document/archive viewing application and may
indicate exploitation of CVE-2026-1186 to gain persistence via a malicious zipx
archive.
logsource:
category: registry_set
product: windows
detection:
selection:
Image|contains:
- Legislator
- EAP Legislator
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
condition: selection
falsepositives:
- Legislator update or install routines that legitimately configure auto-start entries
for the application itself
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1186
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free