CVE-2026-73234

Received Received - Intake

Path Traversal in FreeCAD Prior to 1.1.2

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73234

EUVD

EUVD-2026-56932

Affected Vendors & Products

Vendor	Product	Version / Range
freecad	freecad	to 1.1.2 (exc)
freecad	freecad	1.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-73234 is a path traversal vulnerability in FreeCAD versions 1.1.1 and earlier. It occurs in the PropertyFileIncluded::Restore() function, which combines an attacker-controlled file attribute from Document.xml with the document path without sanitizing it. This allows crafting a malicious .FCStd file (a ZIP archive) containing a Document.xml with path traversal sequences like ../../../.bashrc and a matching ZIP entry. When opened, the payload writes to arbitrary locations, such as the user's home directory.

Detection Guidance

To detect this vulnerability, check FreeCAD version with 'freecad --version' or inspect .FCStd files for malicious Document.xml entries. Look for files with path traversal sequences like '../../' in XML attributes. Use tools like 'zipinfo' to examine archive contents for unexpected file paths.

Impact Analysis

This vulnerability can lead to remote code execution, SSH persistence, credential theft, or system compromise. Attackers could overwrite critical files like shell initialization scripts, SSH keys, or cron jobs. The attack requires user interaction but no privileges. It enables persistence, configuration replacement, or code execution by writing attacker-controlled content to arbitrary accessible locations.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially compromising sensitive data storage locations. For GDPR, this may result in unauthorized access to personal data if files containing such data are overwritten or accessed. For HIPAA, if medical or patient data files are targeted, this could violate confidentiality requirements. The risk stems from the ability to write arbitrary files to arbitrary locations on the system.

Mitigation Strategies

Upgrade FreeCAD to version 1.1.2 or later immediately. Avoid opening .FCStd files from untrusted sources. Implement file validation for any FreeCAD documents received externally. Monitor system files for unauthorized modifications after opening documents.

Hi! I’m here to help you understand CVE-2026-73234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70