What is the CVSS score of CVE-2026-73234?

CVE-2026-73234 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of FreeCAD are affected by CVE-2026-73234?

FreeCAD prior to version 1.1.2 is vulnerable to arbitrary file write attacks when users open crafted design documents, potentially allowing attackers to overwrite critical system or business files…. A patch is available.

How to fix or mitigate CVE-2026-73234?

Within 24 hours, conduct a complete inventory of all FreeCAD deployments and identify systems running versions prior to 1.1.2, then immediately restrict opening of .FCStd files from untrusted or external sources and disable automatic document previews until patching completes. Within 7 days, deploy FreeCAD version 1.1.2 across all affected systems using your standard patch management process and communicate the mandatory update to all users with clear instructions. Within 30 days, verify that all systems have successfully upgraded to version 1.1.2, audit for any remaining unpatched instances, and conduct security awareness training on validating file provenance before opening design documents.

FreeCAD CVE-2026-73234

EUVD-2026-56932 HIGH

Path Traversal (CWE-22)

2026-08-11 security-advisories@github.com

Path Traversal RCE Suse

7.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-open trigger mandates UI:R and AV:L; PR:N because payload is self-contained in archive; C/I/A:H from unrestricted arbitrary file-write within user permission scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 21:01 vuln.today

Analysis Generated

Aug 11, 2026 - 21:01 vuln.today

CVE Published

Aug 11, 2026 - 20:18 cve.org

HIGH 7.8

DescriptionCVE.org

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.

AnalysisAI

Path traversal in FreeCAD prior to version 1.1.2 allows arbitrary file write to any location accessible to the running user when a crafted .FCStd document is opened. The PropertyFileIncluded::Restore() function in src/App/PropertyFile.cpp processes the file and data attributes from Document.xml without sanitizing directory separators, parent traversal sequences, or absolute paths, meaning a malicious ZIP archive containing a matching FileIncluded XML attribute can direct writes outside the intended transient directory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious .FCStd ZIP with traversal path in FileIncluded attribute

Delivery

Deliver archive to target FreeCAD user via email or file sharing

Exploit

User opens document in FreeCAD pre-1.1.2

Execution

Restore() concatenates unvalidated attribute with transient path

Persist

Payload written to attacker-chosen filesystem location

Impact

Achieve persistence or credential theft

Access

Craft malicious .FCStd ZIP with traversal path in FileIncluded attribute

Delivery

Deliver archive to target FreeCAD user via email or file sharing

Exploit

User opens document in FreeCAD pre-1.1.2

Execution

Restore() concatenates unvalidated attribute with transient path

Persist

Payload written to attacker-chosen filesystem location

Impact

Achieve persistence or credential theft

Vulnerability AssessmentAI

Exploitation	The attack requires that a target user open a crafted .FCStd file using FreeCAD prior to version 1.1.2 - confirmed by the CVSS UI:R designation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) is consistent with a file-format vulnerability: the attack vector is local because exploitation is triggered by the act of opening the malicious file, no privileges are required of the attacker since the payload is self-contained, and user interaction is required because the victim must open the document. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a .FCStd ZIP archive in which Document.xml contains a FileIncluded element with the file attribute set to a traversal path such as ../../../../.ssh/authorized_keys or an absolute path like /etc/cron.d/persistence, accompanied by a matching ZIP entry containing attacker-controlled content such as an SSH public key or a cron payload. The file is delivered to a FreeCAD user via email, a shared project repository, or a file-sharing platform with a plausible engineering pretext; when the user opens it, PropertyFileIncluded::Restore() writes the attacker's content to the targeted location under the user's permissions, enabling persistence or lateral movement. …
Remediation	Upgrade to FreeCAD 1.1.2 immediately; this is the vendor-released patch confirmed by the GitHub release tag at https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all FreeCAD deployments and identify systems running versions prior to 1.1.2, then immediately restrict opening of .FCStd files from untrusted or external sources and disable automatic document previews until patching completes. …

Threat intelligence, references, and detailed analysis are available after sign-in.