CVE-2026-32724: Px4 Mavlink Ftp Path Traversal

Constructed paths from MAVLink FTP payloads are used in file system operations without validation for directory traversal sequences. Missing `_validatePath` check can allow an attacker to read/write/delete arbitrary files.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C++
greprules fetch cve-2026-32724-px4-mavlink-ftp-path-traversal --engine opengrep

Description

Constructed paths from MAVLink FTP payloads are used in file system operations without validation for directory traversal sequences. Missing `_validatePath` check can allow an attacker to read/write/delete arbitrary files.