CVE-2026-90444
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-78
- Published
- 2026-09-11
- Last modified
- 2026-09-11
Affected products
- CISA Malcolm
- CISA Malcolm
Weakness type
Related vulnerabilities
- CVE-2026-89066 — OS command injection in the task synthesis component in projen
- CVE-2026-7863 — OS Command Injection in TUBITAK BILGEM's Pardus Software
- CVE-2026-89010 — WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
- CVE-2026-8301 — OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair
- CVE-2026-85979 — Command Injection in Puppet Enterprise
- CVE-2026-17176 — OS command injection Vulnerability in Deco BE11000
- CVE-2026-78569 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-78575 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards