Is there a public PoC exploit available for CVE-2026-10550?

Yes, a public proof-of-concept exploit is available for CVE-2026-10550. Prioritise patching immediately. EPSS: 0.7%.

elunez eladmin CVE-2026-10550

Q: What is the CVSS score of CVE-2026-10550?

CVE-2026-10550 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-33857 LOW

Command Injection (CWE-77)

2026-06-02 VulDB

GHSA-2rwm-2h4j-cr72

Java Command Injection Eladmin

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 02, 2026 - 01:42 vuln.today

DescriptionCVE.org

A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Application Deployment Module. This manipulation of the argument uploadPath causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in elunez eladmin's Application Deployment Module (App.java) allows authenticated remote attackers with low privileges to execute arbitrary operating system commands by manipulating the uploadPath argument. All versions up to and including 2.7 are affected per the CPE record. A public proof-of-concept exploit exists (referenced via GitHub issue #899), though no public exploit identified at time of analysis as confirmed active exploitation (CISA KEV). The vendor has not responded to the coordinated disclosure, leaving no official patch available.

Technical ContextAI

eladmin is a Java-based backend administration framework (tagged Java/Eladmin). The vulnerable component is App.java within the Application Deployment Module, which processes a user-supplied uploadPath argument. CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection) identifies the root cause: user-controlled input is passed into a system-level command or runtime process execution context without adequate sanitization or escaping of shell metacharacters. This class of flaw typically arises when Java code uses Runtime.exec() or ProcessBuilder with string concatenation rather than argument arrays, or delegates to a shell interpreter. The CPE string cpe:2.3:a:elunez:eladmin:*:*:*:*:*:*:*:* covers all versions through 2.7, indicating the flaw is not version-range-specific but rather an architectural deficiency in the deployment module.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer has not responded to the disclosure as of the report date, and no fixed version is available. As a compensating control, administrators should immediately restrict access to the Application Deployment Module to only the minimum necessary privileged accounts, as this reduces the pool of potential attackers from all authenticated low-privilege users to a smaller administrative group (trade-off: operational inconvenience for deployment workflows). Additionally, deploy a web application firewall (WAF) rule to detect and block shell metacharacters (semicolons, pipes, backticks, dollar signs in subshell context) in the uploadPath parameter - note that WAF rules can be bypassed by encoding tricks and should not be treated as a complete fix. Consider running the eladmin application process under a highly restricted OS user account with minimal filesystem and shell execution permissions, so that even successful command injection yields limited OS-level impact. Monitor system logs for anomalous child process creation from the Java application process. Track the upstream GitHub repository (https://github.com/elunez/eladmin/) and issue #899 for any vendor response or patched release.