CVE-2026-73234
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
FreeCAD prior to version 1.1.2 has a vulnerability in PropertyFileIncluded::Restore() that concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive can write attacker-controlled content to arbitrary locations accessible to the FreeCAD user.
Risk Assessment
An attacker can exploit this vulnerability to write files to arbitrary locations, potentially leading to persistence, credential compromise, configuration replacement, or code execution.
Recommendation
Update FreeCAD to version 1.1.2 or later, which fixes this vulnerability. Additionally, do not open untrusted .FCStd files and restrict user privileges.
Original NVD description (English source)
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.