CVE-2026-33642: Critical Zip Slip in Acme File Transfer Server

Detection and hunting guidance

Detection before patching can be difficult if the application does not log ZIP member names or extraction paths in detail. Still, there are a few practical places to hunt. Start with HTTP access logs, reverse proxy logs, and application audit logs for POST requests to /api/v1/import, especially from unusual source IPs, high-frequency upload attempts, or requests followed by application errors or unexpected service changes. On patched systems, the new audit event IMPORT_ZIP_REJECTED_PATH_TRAVERSAL is a strong signal of exploitation attempts or security testing.

You should also review filesystem and process context around the Acme service account. Unexpected file creation or modification outside the normal import workspace shortly after calls to /api/v1/import is suspicious. In environments with EDR or file integrity monitoring, hunt for writes into application config directories, web roots, temp locations used by the service, or startup/script paths accessible to the Acme process. If you lack detailed telemetry, assume gaps remain and prioritize containment plus patching over exhaustive retrospective confidence.

Technical Notes

Example access-log pattern to review:

"POST /api/v1/import HTTP/1.1" 200
"POST /api/v1/import HTTP/1.1" 500
"POST /api/v1/import HTTP/1.1" 400

Example grep-based triage on Linux for application and proxy logs:

grep -R "/api/v1/import" /var/log/nginx/ /var/log/httpd/ /opt/acme/fts/logs/ 2>/dev/null
grep -R "IMPORT_ZIP_REJECTED_PATH_TRAVERSAL" /opt/acme/fts/logs/ 2>/dev/null

Example Splunk query:

(index=web OR index=app)
("/api/v1/import" OR "IMPORT_ZIP_REJECTED_PATH_TRAVERSAL")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri_path, status
| sort - count

Example Sigma-style detection concept for web logs:

title: Acme FTS Import Endpoint Access
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem: /api/v1/import
  condition: selection
level: medium

If you do not have logs that expose ZIP internals, defenders should assume failed uploads and repeated import attempts may still indicate probing. The absence of explicit traversal strings in logs is not proof of non-exploitation.

Mitigation and patching

The authoritative fix is to upgrade to Acme File Transfer Server 5.4.2 or later. The release notes say 5.4.2 adds path normalization, rejects entries that resolve outside the configured import workspace, adds a server-side allowlist for permitted extracted file types, and introduces the audit event IMPORT_ZIP_REJECTED_PATH_TRAVERSAL. That means the patch does more than block one string pattern; it improves extraction safety and observability.

If you cannot upgrade immediately, the documented workaround is to disable the import API endpoint and restrict network access to trusted administrative sources only. Because the research note does not include a vendor-specific configuration knob for disabling /api/v1/import, do not guess at undocumented directives. Instead, defenders should use known control points they already manage, such as reverse proxy rules, WAF policies, ingress controllers, or firewall ACLs, and validate that the endpoint is no longer reachable from untrusted networks.

Technical Notes

If you deploy via container image or package automation, the exact upgrade command depends on your installation method. The sources confirm the fixed version 5.4.2, but they do not document a canonical one-line vendor installer command. In the absence of vendor-published upgrade syntax in the provided material, defenders should use their established package or deployment workflow and verify the installed version afterward.

Example container-based upgrade pattern:

docker pull acme/fts:5.4.2
docker stop acme-fts
docker rm acme-fts
docker run -d --name acme-fts -p 443:443 acme/fts:5.4.2

Example Kubernetes image update:

kubectl set image deployment/acme-fts acme-fts=acme/fts:5.4.2
kubectl rollout status deployment/acme-fts

Example reverse proxy workaround to block the vulnerable endpoint until patching is complete:

location = /api/v1/import {
    deny all;
    return 403;
}

Example verification steps after mitigation:

curl -i -X POST https://fts.example.com/api/v1/import
# Expect 403/404 if endpoint is intentionally blocked

grep -R "IMPORT_ZIP_REJECTED_PATH_TRAVERSAL" /opt/acme/fts/logs/ 2>/dev/null

If you do not know how your instance was installed, treat that as an operational risk indicator. Identify the deployment path first, then patch, rather than improvising commands on production systems.

References

The primary facts in this write-up come from the NVD record, the vendor advisory, the v5.4.2 release notes, and the linked GitHub tracking issue. Those sources consistently state that Acme File Transfer Server 5.0.0 through 5.4.1 is vulnerable, that the flaw affects /api/v1/import, and that 5.4.2 is the fixed version.

For practitioners, the most useful references are the vendor advisory for version scoping and mitigations, and the release notes for fix behavior and new logging. Because public exploitation and PoC status remain unconfirmed in the provided material, continue monitoring the vendor advisory, NVD updates, and trusted threat intelligence feeds for any change in exploitation status.

• Vendor advisory: https://vendor.example.com/security/advisories/AFS-2026-04
• Release notes: https://github.com/acme/fts/releases/tag/v5.4.2
• Tracking issue: https://github.com/acme/fts/issues/1842
• NVD record: NVD entry for CVE-2026-33642

For more information on security vulnerabilities, check our glossary of WPA2 or learn about dependency confusion.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.