AI description
CVE-2026-118869 is an OS command injection vulnerability affecting SHIRASAGI, an open-source content management system and groupware platform. The vulnerability is present in versions v1.19.0 through v1.21.0 of the software. It allows an authenticated attacker to execute arbitrary operating system commands on the server running the application. To trigger the vulnerability, an attacker must have an account with open-data dataset and harvest-management permissions. By saving a crafted URL in the harvest-import settings and running the import process, the attacker can execute OS commands with the privileges of the active server process. The issue has been resolved in version v1.21.1, and there are no reports of active exploitation in real-world attacks.
- Description
- An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
- Source
- vultures@jpcert.or.jp
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 8.7
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.0
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- vultures@jpcert.or.jp
- CWE-78
- Hype score
- Not currently trending