CVE-2026-75031: Code Injection
In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe container which limits the scope of what it can do, unless the non-default AllowGlobal directive is configured for the catalog being accessed.CTOR]
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote users can inject Perl code through the “quick question” admin feature in default installations. No prior login is required.
How does the AllowGlobal directive affect impact?
Injected code normally runs inside a Safe container, which limits its scope. If the non-default AllowGlobal directive is configured for the accessed catalog, those limits may not apply.
What should be checked during triage?
Determine whether the “quick question” admin feature is reachable and whether any catalog has the AllowGlobal directive enabled. Systems using AllowGlobal should be treated as having potentially greater server-side code-execution impact.