FreeCAD CVE-2026-73233

Exploitation requires all of the following: (1) the target system runs FreeCAD prior to version 1.1.2; (2) the victim opens a crafted .FCStd document file - delivery depends on social engineering, phishing, or a compromised shared file location; (3) the victim navigates to a FEM ConstraintDisplacement object within the document and opens its task dialog; (4) the victim clicks Accept (OK/Apply) in the dialog, which triggers TaskDlgFemConstraintDisplacement::accept() and the vulnerable doCommand() call. Documents that contain no FEM Displacement Constraint objects are not exploitable. The FEM workbench must be active and the specific constraint object must be present and opened. Exploitation is not automatable - it cannot be triggered remotely without the victim actively interacting with the dialog, ruling out network-scanning or scripted mass-exploitation. The attack is platform-agnostic across all FreeCAD-supported operating systems. No authentication to any remote system is required, but victim interaction is the binding prerequisite that limits opportunistic exploitation.

The CVSS 4.0 base score of 8.5 with AV:L/AC:L/AT:N/PR:N/UI:P reflects the realistic attack model: the attacker needs no system privileges and faces no technical complexity barrier, but the attack is local in vector (requires the victim to open a crafted file) and requires passive user interaction (the victim must accept the dialog). SSVC corroborates this picture - Automatable: no rules out mass-scanning campaigns, while Technical Impact: total confirms that successful exploitation yields full process-level control. The combination of a confirmed POC, low attack complexity, and total technical impact makes this a high-priority patch target for engineering teams that use FreeCAD's FEM workbench. Absence from CISA KEV suggests no confirmed active exploitation campaigns, but the low remediation friction (a single upgrade to 1.1.2) means the risk-benefit calculation strongly favors patching. EPSS probabilistic data was not provided in the available intelligence and cannot be cited. The local attack vector does not imply low risk: document-format weaponization is a well-established delivery mechanism requiring only social engineering or a shared network drive.

An attacker crafts a FreeCAD project file (.FCStd archive) containing a FEM ConstraintDisplacement object whose xDisplacementFormula property is set to a value such as '\'; import os; os.system("malicious_command"); x = "' - a backslash sequence that escapes the Python string generated by doCommand() and appends arbitrary Python statements. The file is delivered to an engineer via email attachment, Slack share, or a poisoned shared network drive. When the victim opens the file in unpatched FreeCAD, navigates to the FEM Displacement Constraint in the model tree, and clicks Accept in the task dialog, the injected Python executes immediately within the FreeCAD process's privilege context. A proof-of-concept is confirmed available per SSVC data, lowering the barrier to exploitation.