Veille CVE

‹ Retour à la liste

CVE-2026-97359

10.0 Critique

Publiée le 24/09/2026 à 16:18 · Modifiée le 29/09/2026 à 05:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 10.0 Critique disclosure@vulncheck.com CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3.1 10.0 Critique disclosure@vulncheck.com CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Faiblesses (CWE)

Références

Ailleurs