CVE-2026-85672: zerox 1.1.20 OS Command Injection via Document URL File Extension
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker needs to supply or influence a document URL whose file extension contains command-substitution syntax. The malicious extension is used unsafely in shell commands before document processing occurs.
Can this be exploited remotely without authentication or user interaction?
The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction. This implies exposure where an attacker can cause the application to process an attacker-controlled document URL.
What is the impact of successful exploitation?
Successful exploitation can execute arbitrary operating-system commands in the context of the process running zerox. The provided severity vector indicates high impacts to confidentiality, integrity, and availability.