What is the CVSS score of CVE-2026-50874?

CVE-2026-50874 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.7%.

Which versions of Reminiscence are affected by CVE-2026-50874?

kanishka-linux Reminiscence v0.3.0 contains an authenticated command injection vulnerability enabling arbitrary OS command execution by low-privilege users, creating risk of complete system…

How to fix or mitigate CVE-2026-50874?

24 hours: Inventory all instances of kanishka-linux Reminiscence v0.3.0; restrict network access to /manage/features/media endpoint to trusted internal networks only; disable the media features component if not operationally critical. 7 days: Deploy Web Application Firewall (WAF) rules blocking command injection payloads and OS command metacharacters; enable security event logging and alerting on /manage/features/media requests; brief security operations and system administrators on exploitation signatures and response procedures. 30 days: Since no vendor patch is available, execute one of: (1) upgrade to a confirmed secure major version if available from the vendor, (2) replace the product with a hardened alternative, or (3) deploy persistent compensating controls including host-based intrusion detection, mandatory application-layer input validation, and privilege isolation for the Reminiscence process.

Reminiscence CVE-2026-50874

EUVD-2026-36772 HIGH

OS Command Injection (CWE-78)

2026-06-15 mitre

GHSA-mq35-3m5c-7282

Command Injection N A

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N), single crafted request (AC:L), authenticated /manage/ path (PR:L), no user interaction; arbitrary OS command execution yields full C/I/A impact, so A:H rather than NVD's A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 19:23 vuln.today

CVSS changed

Jun 16, 2026 - 19:22 NVD

8.1 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 15, 2026 - 00:00 cve.org

HIGH 8.1

DescriptionCVE.org

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

AnalysisAI

Authenticated command injection in kanishka-linux Reminiscence v0.3.0 lets remote attackers execute arbitrary OS commands by submitting crafted input to the /manage/features/media endpoint. The flaw maps to CWE-78 with CVSS 8.1 (PR:L), and publicly available exploit code exists in a referenced gist; EPSS is modest at 0.66% (47th percentile) and the issue is not on CISA KEV.

Technical ContextAI

Reminiscence is an open-source self-hosted bookmark/archive web application written in Python (Django) by kanishka-linux. The vulnerable /manage/features/media handler invokes an underlying OS-level command (typical for media-processing features such as wget, youtube-dl, ffmpeg, or pdf/image converters) and incorporates user-supplied input into that command without proper neutralization, the canonical CWE-78 'Improper Neutralization of Special Elements used in an OS Command' pattern. Because no shell metacharacter filtering or argument-list execution is enforced, supplying input containing characters like ';', '|', '$()' or backticks breaks out of the intended command and runs attacker-chosen processes under the privileges of the Reminiscence service account.

RemediationAI

No vendor-released patch identified at time of analysis - the project has no published advisory and CPE/EUVD list no fixed version, so operators should monitor the upstream repository https://github.com/kanishka-linux/reminiscence for a release succeeding 0.3.0 and apply it once available. In the interim, restrict /manage/features/media to trusted administrators only by enforcing strong authentication and IP-allowlisting at a reverse proxy (nginx/Caddy) in front of Reminiscence, disable or remove the media-import feature if not required, run the application as an unprivileged user inside a container or systemd sandbox with NoNewPrivileges and a read-only filesystem to contain the blast radius of any successful injection, and audit existing low-privilege accounts since CVSS PR:L means any authenticated user can exploit it. Consult https://nvd.nist.gov/vuln/detail/CVE-2026-50874 and the PoC at https://gist.github.com/pyuysig/7df16c08213f809592bbc7053c079aba to build detection rules for shell metacharacters in POST bodies to that endpoint; note that aggressive metacharacter filtering at the proxy may break legitimate media URLs containing '?' or '&'.