FreeCAD CVE-2026-73234

The attack requires that a target user open a crafted .FCStd file using FreeCAD prior to version 1.1.2 - confirmed by the CVSS UI:R designation. No authentication or system-level privileges are required of the attacker (CVSS PR:N); the malicious payload is entirely self-contained within the document archive. No non-default FreeCAD configuration is needed: the vulnerable PropertyFileIncluded::Restore() code path is invoked unconditionally whenever any .FCStd document is opened through the standard document restoration mechanism. Exploitation is bounded by the OS permissions of the user running FreeCAD - the attacker cannot write to locations that the FreeCAD process user cannot write to, meaning root-owned system files are not reachable on a properly configured system unless FreeCAD is run with elevated privileges. The primary limiting factor is delivery: the attacker must persuade the victim to open the malicious file, which requires a social engineering step such as a convincing project file shared in a collaborative context. The attack is platform-agnostic, applying to Windows, macOS, and Linux builds equally, with path traversal payloads adapting to the target OS path separator conventions (the fix explicitly tests both forward-slash and backslash traversal).

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) is consistent with a file-format vulnerability: the attack vector is local because exploitation is triggered by the act of opening the malicious file, no privileges are required of the attacker since the payload is self-contained, and user interaction is required because the victim must open the document. The high Confidentiality, Integrity, and Availability scores reflect the unconstrained file-write primitive, which can target shell initialization files, SSH authorized_keys, cron entries, or application binaries within the user's permission scope. No EPSS score was provided, limiting probabilistic assessment; this vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, which moderately lowers urgency compared to actively exploited file-format flaws. The practical delivery mechanism - sharing .FCStd files via email, cloud storage, or collaborative platforms - means even a mid-sized municipal IT team in legnica that deploys FreeCAD across engineering workstations should treat this as a medium-priority patch, since the social engineering bar is low and the post-exploitation impact is high. The AV:L designation may create a false sense of distance: while it correctly reflects the local file-open trigger, it does not imply the attacker needs physical access - remote delivery via any file-sharing channel is sufficient.

An attacker crafts a .FCStd ZIP archive in which Document.xml contains a FileIncluded element with the file attribute set to a traversal path such as ../../../../.ssh/authorized_keys or an absolute path like /etc/cron.d/persistence, accompanied by a matching ZIP entry containing attacker-controlled content such as an SSH public key or a cron payload. The file is delivered to a FreeCAD user via email, a shared project repository, or a file-sharing platform with a plausible engineering pretext; when the user opens it, PropertyFileIncluded::Restore() writes the attacker's content to the targeted location under the user's permissions, enabling persistence or lateral movement. No public proof-of-concept exploit has been identified at time of analysis, but construction of such an archive requires only standard ZIP tooling and knowledge of the .FCStd format, which is publicly documented.