Which versions of Docker are affected by CVE-2026-34977?

Aperi'Solve versions prior to 3.2.1 contain a critical unauthenticated remote code execution vulnerability in JPEG upload handling that allows attackers to execute arbitrary commands at root level…. A patch is available.

How to fix or mitigate CVE-2026-34977?

Within 24 hours: Identify all Aperi'Solve instances and their versions (check docker images, deployment manifests). If running <3.2.1, immediately isolate from internet or restrict network access to trusted sources only. Within 7 days: Upgrade all instances to Aperi'Solve 3.2.1 or later per vendor release notes; test in non-production environment first. Within 30 days: Review access logs for successful JPEG uploads to exploited instances during exposure window; audit PostgreSQL and Redis database access; if Docker socket is mounted, conduct full host system security assessment.

Docker CVE-2026-34977

Q: What is the CVSS score of CVE-2026-34977?

CVE-2026-34977 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19361 CRITICAL

OS Command Injection (CWE-78)

2026-04-06 GitHub_M

Docker Command Injection Redis PostgreSQL Aperisolve

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 19:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.2.1

EUVD ID Assigned

Apr 06, 2026 - 16:45 euvd

EUVD-2026-19361

Analysis Generated

Apr 06, 2026 - 16:45 vuln.today

CVE Published

Apr 06, 2026 - 16:16 nvd

CRITICAL 9.3

DescriptionCVE.org

Aperi'Solve is an open-source steganalysis web platform. Prior to 3.2.1, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. This password is then directly passed into an expect command, which is then subsequently passed into a bash -c command, without any form of sanitization or validation. An unauthenticated attacker can achieve root-level RCE inside the worker container with a single HTTP request, enabling full read/write access to all user-uploaded images, analysis results, and plaintext steganography passwords stored on disk. Because the container shares a Docker network with PostgreSQL and Redis (no authentication on either), the attacker can pivot to dump the entire database or manipulate the job queue to poison results for other users. If Docker socket mounting or host volume mounts are present, this could escalate to full host compromise. This would also include defacement of the website itself. This vulnerability is fixed in 3.2.1.

AnalysisAI

Unauthenticated remote code execution (RCE) at root level in Aperi'Solve <3.2.1 allows attackers to execute arbitrary commands via unsanitized password input in JPEG upload functionality. Attack requires no authentication (PR:N) and low complexity (AC:L), with CVSS 9.3 critical severity. Publicly available exploit code exists via GitHub advisory. Attackers gain full container compromise with potential pivot to PostgreSQL/Redis databases and, in misconfigured deployments with Docker socket mounts, possible host system takeover. EPSS data not provided, but given unauthenticated network-based vector and public disclosure with fix details, exploitation risk is substantial for exposed instances.

Technical ContextAI

Aperi'Solve is a web-based steganography analysis platform (cpe:2.3:a:zeecka:aperisolve) that processes user-uploaded images. The vulnerability stems from CWE-78 (OS Command Injection) in the JPEG processing workflow. When users upload JPEG files with an optional password parameter for steganography extraction, the application passes this password directly into an 'expect' command construct, which is subsequently executed via 'bash -c' without input validation or sanitization. This creates a classic command injection vector where shell metacharacters in the password field are interpreted as commands. The worker container runs with root privileges and shares a Docker network with backend services (PostgreSQL database and Redis queue) that lack authentication, creating a lateral movement opportunity. The architecture demonstrates insufficient input validation at the application layer combined with excessive container privileges and inadequate network segmentation.

RemediationAI

Upgrade immediately to Aperi'Solve version 3.2.1 or later, released by the vendor to address this vulnerability (https://github.com/Zeecka/AperiSolve/releases/tag/3.2.1). The fix implemented in commit 0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4 (https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4) and merged via pull request #195 (https://github.com/Zeecka/AperiSolve/pull/195) introduces proper input sanitization for password parameters before shell command execution. For organizations unable to upgrade immediately, implement network-level access controls to restrict Aperi'Solve exposure to trusted networks only, though this is a temporary mitigation-the vulnerability remains exploitable by any user with access. Review container configurations to remove unnecessary Docker socket mounts, implement principle of least privilege for container runtime (avoid root), and add authentication to PostgreSQL and Redis services to limit lateral movement potential. After patching, conduct security review of uploaded content and database integrity, as prior exploitation may have occurred undetected.