CVE-2026-45777
Remote Code Execution in OpenXDMoD
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ubccr | open_xdmod | From 9.5.0 (inc) to 11.0.2 (inc) |
| ubccr | open_xdmod | 11.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-45777 allows an attacker to remotely execute arbitrary system commands on the web server hosting Open XDMoD, potentially leading to unauthorized access, modification of application data, alteration of system configuration, or disruption of service availability.
Such unauthorized access and potential data breaches could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.
However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability allows remote code execution via OS command injection in Open XDMoD versions 9.5.0 through 11.0.2. Detection involves checking if your system is running a vulnerable version of Open XDMoD and monitoring for suspicious command execution or unusual web server activity.
To detect the vulnerability on your system, first verify the installed Open XDMoD version. You can do this by checking the version information in the application or by running a command like:
- grep -i version /path/to/xdmod/version/file or checking the application UI for version info.
If the version is between 9.5.0 and 11.0.2 inclusive, your system is vulnerable unless patched.
To detect exploitation attempts or suspicious activity, you can monitor web server logs for unusual requests that might include command injection payloads. For example, you can search for suspicious patterns in Apache or Nginx logs with commands like:
- grep -iE "(\;|\&\&|\|\|)" /var/log/apache2/access.log
- grep -iE "(\;|\&\&|\|\|)" /var/log/nginx/access.log
Additionally, monitoring for unexpected processes or commands executed by the web server user can help detect exploitation. For example, you can use:
- ps -u www-data -o pid,cmd
- or check recent commands run by the web server user in shell history files if accessible.
Ultimately, the best mitigation is to upgrade Open XDMoD to version 11.0.3 or later or apply the provided patch.
Can you explain this vulnerability to me?
CVE-2026-45777 is a critical security vulnerability in Open XDMoD versions 9.5.0 through 11.0.2 that allows an attacker to remotely execute arbitrary system commands on the web server hosting Open XDMoD.
The vulnerability arises from improper escaping of user-controlled input in SVG metadata fields during SVG-to-PNG and SVG-to-PDF conversions, which leads to OS command injection.
Specifically, the original code used an insufficient escaping function (`addcslashes()`), which was replaced by a safer function (`escapeshellarg()`) in the patch to properly quote shell arguments and prevent command injection.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary system commands on the web server with the privileges of the web server process.
- Read or modify application data.
- Alter system configuration.
- Disrupt service availability.
Because the attack can be performed remotely without authentication, it poses a high risk to affected systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in Open XDMoD versions 9.5.0 through 11.0.2, you should upgrade to version 11.0.3 where the issue is patched.
If immediate upgrade is not possible, apply the manual patch provided which fixes improper escaping of user-controlled input in SVG metadata fields by replacing addcslashes() with escapeshellarg() to prevent command injection.
- Download the patch file from the official source.
- Copy the patch file to the web server hosting Open XDMoD.
- Run the patch command with the correct directory paths to apply the fix.