CVE-2026-85672

CriticalCVSS 9.8/10Last modified Sep 23, 2026

Description

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-856737.5LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unaCVE-2026-856747.8aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A craftedCVE-2026-856757.5OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches calleCVE-2026-856764.3Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domaCVE-2026-856778.8The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context iCVE-2026-856786.8The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tagCVE-2026-856797.2The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, anCVE-2026-856808.8The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it inCVE-2026-856819.8The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unaCVE-2026-856828.8The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the CVE-2026-856838.8The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by CVE-2026-856849.1marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename