CVE-2026-118869
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
An OS command injection vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary OS commands on the system running the product.
Risk Assessment
An authenticated attacker can take control of the application server and perform arbitrary operations on the system. This poses a serious threat to data confidentiality, integrity, and availability.
Recommendation
Update SHIRASAGI to a version containing the fix. Restrict application account privileges and monitor for unusual system command invocations.
Other vulnerabilities in SHIRASAGI
See all- CVE-2026-117679Medium
A cross-site scripting vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
- CVE-2026-82582Medium
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
- CVE-2026-81635Medium
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
Original NVD description (English source)
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS