CVE-2026-34596

HighCVSS 7.0/10Last modified Jul 24, 2026

Description

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required.

This issue has been fixed in version 1.17.3.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
sandboxie-plus	Sandboxie	< 1.17.3

References

https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585Exploit, Vendor Advisory
https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585Exploit, Vendor Advisory

Timeline

Published: May 5, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-345978.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Auth CVE-2026-345986.1YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A mali CVE-2026-345998.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an aut CVE-2026-34605.3The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1 CVE-2026-346005.7Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a CVE-2026-346017.5xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and p CVE-2026-346027.1Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable CVE-2026-346038.3Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev m CVE-2026-346048.8Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in Filesyst CVE-2026-346056.1SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version CVE-2026-346066.1Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version CVE-2026-346077.2Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() functio