VULNERABILITY INTELLIGENCE

CVE-2026-64879

CVSS score9.4 CRITICAL
EPSS probability2.26%
CISA KEVNot currently listed
Published2026-07-21
Last modified2026-10-24
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Weakness classification

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references