CVE Catalog
CVE-2026-64878
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk0.54%
42th percentile - higher than 42% of all known CVEs
Summary
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Risk Assessment
An attacker can execute arbitrary system commands as a low-privileged user, potentially leading to privilege escalation or data theft.
Recommendation
Implement input validation for filter parameters. Restrict access to the Analysis REST endpoint.
Original NVD description (English source)
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.