CVE-2026-90444

Received Received - Intake

File Name Command Injection in File Transfer Interface

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90444

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves a file-transfer interface that accepts attacker-controlled filenames without blocking shell metacharacters. An automated process later uses the filename to construct and execute a system command, allowing an authenticated attacker to inject and run arbitrary OS commands with the process's privileges.

Detection Guidance

Detecting this vulnerability requires checking for file-transfer interfaces that accept filenames without proper sanitization. Monitor logs for unusual command execution patterns or file uploads containing shell metacharacters like semicolons, backticks, or pipes. Inspect automated processes that handle uploaded files for command construction vulnerabilities.

Impact Analysis

An attacker could read or modify log data processed by the system and gain a foothold to move further into the internal network. This could lead to data breaches, unauthorized access, or additional attacks depending on the system's role.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive data.

Mitigation Strategies

Validate and sanitize all filenames before processing, removing or escaping shell metacharacters.
Restrict file-transfer interface credentials to prevent unauthorized access.
Review and harden automated processes that handle uploaded files to prevent command injection.
Implement strict input validation for filenames and log all file upload activities.

Hi! I’m here to help you understand CVE-2026-90444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70