CVE-2026-64879

CriticalCVSS 9.9/10Last modified Oct 24, 2026

Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-64886.3A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability affects unknown code of t CVE-2026-648807.1Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or paramete CVE-2026-648818.8The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input v CVE-2026-648877.0Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: be CVE-2026-64896.3A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown process CVE-2026-648926.3- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This CVE-2026-648937.3- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issu CVE-2026-648965.2Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Co CVE-2026-648975.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-648987.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-648995.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-64907.3A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file