# ABC PRO EAP Legislator path traversal flaw

Published: 2026-02-02 · Severity: medium
Canonical: https://vorant.io/reports/c74f7516-82d0-5a51-aa52-ade40d4d08b8/abc-pro-eap-legislator-path-traversal-flaw

> A path traversal vulnerability in ABC PRO EAP Legislator allows attackers to extract malicious files to arbitrary system locations via crafted zipx archives.

CERT Polska coordinated the disclosure of CVE-2026-1186, a path traversal vulnerability in ABC PRO EAP Legislator software. The flaw exists in the application's file extraction functionality, where specially crafted zipx archives—the default file type used by Legislator—can extract files to arbitrary paths outside the intended directory, including sensitive system locations such as the startup directory. An attacker exploiting this vulnerability would need to deliver a malicious zipx file to a victim and convince them to open it with the vulnerable application.

The vulnerability was responsibly reported by researcher Marcin Ressel and has been addressed by the vendor in version 2.25a. Organizations using ABC PRO EAP Legislator should update to the patched version to mitigate the risk of arbitrary file write attacks that could lead to code execution or system compromise.

This disclosure follows CERT Polska's coordinated vulnerability disclosure process, demonstrating effective collaboration between security researchers, coordination bodies, and vendors to address security issues before they can be widely exploited.

## Mentioned in this report

- Vulnerabilities: CVE-2026-1186

## Detection guidance (public sample)

### File Written to Startup Folder by ABC PRO EAP Legislator (Possible CVE-2026-1186 Exploitation)

ATT&CK: T1547.001

Detects Legislator archive extraction writing files into the Windows Startup folder, indicating path traversal exploitation of CVE-2026-1186 via a malicious zipx archive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File Written to Startup Folder by ABC PRO EAP Legislator
id: 1c59305d-54a7-562e-a718-f60ee4258d15
status: experimental
description: Detects files being written to the Startup folder by the ABC PRO EAP
  Legislator application, which may indicate exploitation of the CVE-2026-1186 path
  traversal vulnerability during zipx archive extraction, resulting in persistence
  via the Startup directory.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains:
    - Legislator
    - EAP Legislator
    TargetFilename|contains:
    - \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
    - \\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
  condition: selection
falsepositives:
- Legitimate use of Legislator to install shortcuts or add-ins intended for the Startup
  folder (rare and should be verified)
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
```

### Registry Run Key Set by ABC PRO EAP Legislator Process

ATT&CK: T1547.001

Detects a Run/RunOnce registry value being created by the Legislator application process, consistent with abuse of the CVE-2026-1186 path traversal flaw to achieve persistence outside normal extraction directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Registry Run Key Created by ABC PRO EAP Legislator
id: c076b58a-606a-5770-b63b-ba473adf0d29
status: experimental
description: Detects the Legislator application writing to Run/RunOnce registry keys,
  which is unexpected behavior for a document/archive viewing application and may
  indicate exploitation of CVE-2026-1186 to gain persistence via a malicious zipx
  archive.
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    Image|contains:
    - Legislator
    - EAP Legislator
    TargetObject|contains:
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\Run
    - \\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce
  condition: selection
falsepositives:
- Legislator update or install routines that legitimately configure auto-start entries
  for the application itself
level: high
tags:
- attack.persistence
- attack.t1547.001
- cve.2026-1186
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1186

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c74f7516-82d0-5a51-aa52-ade40d4d08b8/abc-pro-eap-legislator-path-traversal-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup