EUVD-2026-59848
GHSA-fxrg-9hfp-v3x8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint (AV:N) requires low-privilege auth (PR:L); GroovyShell.evaluate enables arbitrary JVM and OS code execution, warranting high vulnerable-system impact and low subsequent-system impact via OS access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
AnalysisAI
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
Technical ContextAI
The vulnerability stems from the misuse of Groovy's GroovyShell.evaluate API within the NoticeController component of this JVM-based notice management application. CWE-94 (Improper Control of Generation of Code) captures the root cause: attacker-controlled input is passed to GroovyShell.evaluate without sanitization, allowing arbitrary Groovy - and by extension arbitrary Java - code to execute within the application's JVM process. Because Groovy scripts can invoke Java's Runtime.getRuntime().exec() and similar APIs, the practical blast radius of this flaw extends well beyond the bounded VC:L/VI:L/VA:L impact values recorded in the CVSS 4.0 vector. The affected endpoint /execute is network-accessible and reachable by low-privilege users. The CPE string cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:* applies a wildcard version field, indicating the version scope has not been narrowed to a single release, though the description specifically references version 2.0.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has acknowledged the report with 'it's being processed' but no fix version is available from any reference. As an immediate compensating control, restrict network access to the /execute endpoint via a reverse proxy ACL or host-based firewall rule limited to trusted IP ranges only - note this may interrupt legitimate functionality if the endpoint serves authorized users. Enforce additional perimeter authentication such as VPN or IP allowlisting to raise the bar beyond the application's own low-privilege requirement. If Groovy script execution is not a required business function, consider disabling or removing the /execute endpoint entirely until a patch is available, as this eliminates the attack surface with no side effects on other features. Monitor the GitHub repository at https://github.com/DefaultFuction/Notice-System-Managent/ and VulDB entry https://vuldb.com/vuln/390703 for patch availability and apply immediately upon release.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today