CVE-2026-2333
CriticalSummary
W wersji 2.2.0.4 Owl opds występuje podatność na wstrzykiwanie poleceń z powodu niewłaściwego neutralizowania specjalnych elementów w komendach. Atakujący może wykorzystać spreparowane żądanie sieciowe do wykonania nieautoryzowanych poleceń.
Risk Assessment
Podatność ta może prowadzić do przejęcia kontroli nad systemem, co stwarza poważne zagrożenie dla bezpieczeństwa danych i infrastruktury organizacji.
Recommendation
Zaleca się aktualizację do najnowszej wersji oprogramowania, która eliminuje tę podatność oraz wdrożenie mechanizmów zabezpieczających przed wstrzykiwaniem poleceń.
Related vulnerabilities
- CVE-2026-93945Critical
Deserialization of Untrusted Data vulnerability in the Balance theme by Axiomthemes allows Object Injection. This issue affects Balance from n/a through 1.12.0.
- CVE-2026-93944Critical
Deserialization of Untrusted Data vulnerability in the Camelia theme by ThemeREX Group allows Object Injection. This issue affects Camelia from n/a through 1.2.15.
- CVE-2026-93943Critical
Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.
- CVE-2026-93942Critical
Deserialization of Untrusted Data vulnerability in the Dwell theme by ThemeREX Group allows Object Injection. This issue affects Dwell from n/a through 1.16.0.
- CVE-2026-93941Critical
Deserialization of Untrusted Data vulnerability in the Edema theme by ThemeREX Group allows Object Injection. This issue affects Edema from n/a through 1.2.2.2.
- CVE-2026-93940Critical
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
- CVE-2026-93938Critical
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
- CVE-2026-93937Critical
Deserialization of Untrusted Data vulnerability in the Hygia theme by ThemeREX Group allows Object Injection. This issue affects Hygia from n/a through 1.21.0.
- CVE-2026-93936Critical
Deserialization of Untrusted Data vulnerability in the IPharm theme by ThemeREX Group allows Object Injection. This issue affects IPharm from n/a through 1.2.4.
- CVE-2026-93935Critical
Deserialization of Untrusted Data vulnerability in the Let's Play theme by ThemeREX Group allows Object Injection. This issue affects Let's Play from n/a through 1.1.15.
Original NVD description (English source)
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS