CVE-2026-10550: elunez eladmin Application Deployment App.java command injection
A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Application Deployment Module. This manipulation of the argument uploadPath causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
elunez/eladmin Application Deployment Module (App.java)from your environment.Uninstall or remove the Application Deployment Module from affected deployments to eliminate the vulnerable code path handling uploadPath until a fix is provided.
- Configuration
Disable the Application Deployment Module to prevent processing of the uploadPath parameter (App.java) until a vendor fix is available.
elunez/eladmin Application Deployment Module application_deployment_enabled = false - Compensating control
Restrict network access to the application deployment endpoints and management interfaces to trusted IPs or via VPN; deploy WAF rules or IDS/IPS signatures to block attempts to inject commands via the uploadPath parameter and other suspicious input patterns.
- Operational
Monitor logs and intrusion detection alerts for attempts to exploit the uploadPath command injection; audit recent deployments and running processes for signs of compromise and roll back or remediate any suspicious changes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10550?
The severity of CVE-2026-10550 is classified as low with a score of 2.1.
What type of vulnerability is CVE-2026-10550?
CVE-2026-10550 is a command injection vulnerability affecting the elunez eladmin Application Deployment Module.
How do I fix CVE-2026-10550?
To fix CVE-2026-10550, ensure that you sanitize and validate the 'uploadPath' input in the App.java file to prevent command injection.
Who is affected by CVE-2026-10550?
CVE-2026-10550 affects users of the elunez eladmin application versions up to 2.7.
Can CVE-2026-10550 be exploited remotely?
Yes, CVE-2026-10550 can be exploited remotely due to the nature of the command injection vulnerability.