What is the CVSS score of CVE-2026-38450?

CVE-2026-38450 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Aetopia DAM are affected by CVE-2026-38450?

Aetopia Digital Asset Management v1.0.0 contains a critical remote code execution vulnerability with public exploit code; no authentication is required.

How to fix or mitigate CVE-2026-38450?

Identify all Aetopia DAM v1.0.0 instances within 24 hours and assess their network accessibility and operational criticality. Within 7 days, restrict network access to the DAM application (limiting to internal-only if possible), deploy Web Application Firewall rules to block requests containing template injection patterns in the 'name' and 'description' parameters, and contact Aetopia for patch timeline. Within 30 days, either upgrade to a patched version of Aetopia DAM if the vendor releases one, migrate to an alternative DAM solution, or if the system is operationally critical and unavoidable, maintain it in a segmented network with enhanced monitoring and logging.

Aetopia DAM CVE-2026-38450

EUVD-2026-44579 CRITICAL

Code Injection (CWE-94)

2026-07-14 cve@mitre.org

GHSA-gq83-g5c5-qrrq

RCE Code Injection

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SSTI-to-RCE with total impact, but the Add/Update Project function is normally authenticated, so PR:L rather than the NVD PR:N; low complexity and no user interaction.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:26 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 14, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 22:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function

AnalysisAI

Remote code execution in Aetopia Digital Asset Management (DAM) v1.0.0 is achievable through a server-side template injection flaw: attacker-controlled input in the 'name' and 'description' parameters of the Add/Update Project function is evaluated by the server-side template engine, letting an attacker run arbitrary code on the host. NVD scores this CVSS 9.8 (network, low complexity, no privileges required), and a public researcher writeup detailing the SSTI exists on the eslam3kl GitBook; however, there is no public exploit identified as weaponized code and it is not listed in CISA KEV, so it is not confirmed as actively exploited. Note the CVSS PR:N rating conflicts with the fact that Add/Update Project is normally an authenticated application feature.

Technical ContextAI

Aetopia DAM is an enterprise Digital Asset Management platform (vendor: aetopia.com) used to catalog, store, and manage media/creative assets. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection), and the referenced advisory specifically characterizes it as Server-Side Template Injection (SSTI). SSTI occurs when user-supplied data is concatenated directly into a server-side template that is then rendered, causing the template engine to evaluate injected expressions rather than treat them as inert data. Because template engines expose object introspection and, in many stacks, access to runtime/OS primitives, expression injection commonly escalates from information disclosure to full remote code execution - which is what the RCE and Code Injection tags reflect here. The exact template engine and language are not disclosed in the provided data.

RemediationAI

No vendor-released patch or fixed version was identified at time of analysis, and no vendor security advisory URL was provided (only the vendor marketing page and a third-party researcher writeup), so a specific upgrade target cannot be cited. As compensating controls: restrict network access to the Aetopia DAM application and specifically to the Add/Update Project endpoints via network segmentation or a reverse-proxy allowlist so only trusted, authenticated operators can reach them (trade-off: may block legitimate remote project editing); enforce and audit authentication/authorization on the project management functions to remove any unauthenticated path (addresses the PR:N concern); deploy a WAF rule to inspect and block template-injection payloads (e.g. characters/sequences like ${...}, {{...}}, #{...}, <%...%>) in the name and description fields (trade-off: engine-dependent bypasses and possible false positives on legitimate content); and add server-side input validation/output-context escaping for those fields. Contact Aetopia directly to obtain a patched build and monitor https://nvd.nist.gov/vuln/detail/CVE-2026-38450 for an official fix.