CVE-2026-64881

Received Received - Intake

Command Injection in Audit File Upload Handler

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Tenable Network Security, Inc.

Description

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-64881

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves an audit file upload handler that fails to sanitize filenames. Attackers can inject shell metacharacters into filenames, which are then passed to system commands. When combined with another vulnerability, this allows command injection attacks.

Detection Guidance

Detecting this vulnerability requires checking for unsanitized filename handling in file upload handlers. Review audit logs for file upload requests containing shell metacharacters like semicolons, backticks, or command substitution symbols. Inspect system logs for unexpected command execution after file uploads.

Impact Analysis

An attacker could execute arbitrary commands on the system with the privileges of the vulnerable application. This may lead to data theft, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately patch the audit file upload handler to sanitize filenames by removing or escaping shell metacharacters. Implement strict input validation for filenames and restrict file upload permissions. Monitor for unusual command execution patterns in system logs.

Hi! I’m here to help you understand CVE-2026-64881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70