CVE-2026-42168

9.1 Critique

Publiée le 17/07/2026 à 22:17 · Modifiée le 23/07/2026 à 20:28 · Analyse NVD reportée · Source : cve@mitre.org

Description

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.

Traduire en français

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-78

Références

https://github.com/abhishek-ram/django-pyas2
https://github.com/abhishek-ram/django-pyas2/releases/tag/v1.2.3
https://github.com/m4ty-m/vulnerability-research/tree/main/CVE-2026-42168

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories