ABC PRO EAP Legislator path traversal flaw
A path traversal vulnerability in ABC PRO EAP Legislator allows attackers to extract malicious files to arbitrary system locations via crafted zipx archives.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-1186, a path traversal vulnerability in ABC PRO EAP Legislator software. The flaw exists in the application's file extraction functionality, where specially crafted zipx archives—the default file type used by Legislator—can extract files to arbitrary paths outside the intended directory, including sensitive system locations such as the startup directory. An attacker exploiting this vulnerability would need to deliver a malicious zipx file to a victim and convince them to open it with the vulnerable application.
The vulnerability was responsibly reported by researcher Marcin Ressel and has been addressed by the vendor in version 2.25a. Organizations using ABC PRO EAP Legislator should update to the patched version to mitigate the risk of arbitrary file write attacks that could lead to code execution or system compromise.
This disclosure follows CERT Polska's coordinated vulnerability disclosure process, demonstrating effective collaboration between security researchers, coordination bodies, and vendors to address security issues before they can be widely exploited.
Mentioned in this report
Detection guidance
File Written to Startup Folder by ABC PRO EAP Legislator (Possible CVE-2026-1186 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Legislator archive extraction writing files into the Windows Startup folder, indicating path traversal exploitation of CVE-2026-1186 via a malicious zipx archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Written to Startup Folder by ABC PRO EAP Legislator
id: 1c59305d-54a7-562e-a718-f60ee4258d15
status: experimental
description: Detects files being written to the Startup folder by the ABC PRO EAP
Legislator application, which may indicate exploitation of the CVE-2026-1186 path
traversal vulnerability during zipx archive extraction, resulting in persistence
via the Startup directory.
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- Legislator
- EAP Legislator
TargetFilename|contains:
- \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
- \\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
condition: selection
falsepositives:
- Legitimate use of Legislator to install shortcuts or add-ins intended for the Startup
folder (rare and should be verified)
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
Registry Run Key Set by ABC PRO EAP Legislator Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Run/RunOnce registry value being created by the Legislator application process, consistent with abuse of the CVE-2026-1186 path traversal flaw to achieve persistence outside normal extraction directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Registry Run Key Created by ABC PRO EAP Legislator
id: c076b58a-606a-5770-b63b-ba473adf0d29
status: experimental
description: Detects the Legislator application writing to Run/RunOnce registry keys,
which is unexpected behavior for a document/archive viewing application and may
indicate exploitation of CVE-2026-1186 to gain persistence via a malicious zipx
archive.
logsource:
category: registry_set
product: windows
detection:
selection:
Image|contains:
- Legislator
- EAP Legislator
TargetObject|contains:
- \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
- \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
condition: selection
falsepositives:
- Legislator update or install routines that legitimately configure auto-start entries
for the application itself
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1186
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs