EUVD-2026-78148
GHSA-pxv8-q499-379f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file.
AnalysisAI
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today