CVE-2026-71452

HighCVSS 7.2/10Last modified Oct 2, 2026

Description

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.

This issue affects EasyIO FS32: before 3.0b63.

Metrics

CVSS 4.0 7.2/10CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-714535.6- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO CVE-2026-714545.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63CVE-2026-714585.0URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 sCVE-2026-714595.0JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through CVE-2026-71467.3A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by tCVE-2026-714604.3/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, skCVE-2026-714614.3HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers CVE-2026-714624.1StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 respCVE-2026-714632.7Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) CVE-2026-714643.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobCVE-2026-714653.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(CVE-2026-714677.5A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a reque