Interchange EUVD-2026-82993

The vulnerable feature is the admin 'quick question' page (dist/lib/UI/pages/admin/quick_question.html), reachable and injectable by unauthenticated users in DEFAULT installations - the fix confirms this by newly adding an [if-mm super] superuser restriction that was previously absent. Injected Perl is evaluated because attacker input flowed into a reparsed [calc] block; the fix sets reparse=0 and entity-filters the CGI yes/no parameters. The KEY limiting factor on impact: injected code executes inside Interchange's Safe compartment, which restricts available Perl opcodes/operations; UNRESTRICTED server-side RCE requires the non-default AllowGlobal directive to be enabled for the accessed catalog. Thus default installs are exploitable for constrained (sandboxed) code execution, while full-impact RCE additionally requires AllowGlobal=1.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) and SSVC (Automatable: yes, Technical Impact: total) both point to a serious, network-reachable, unauthenticated code-injection flaw - normally a top-priority patch. However, key signals moderate this: SSVC Exploitation status is 'none', there is no CISA KEV listing, no EPSS score is provided in the input, and no public POC is referenced (only the vendor advisory and the fix commit), so exploitation status is 'no public exploit identified at time of analysis'. Critically, the description itself contradicts the 9.8 impact rating: injected Perl runs inside a restrictive Safe compartment by default, and full unconstrained RCE only occurs when the NON-DEFAULT AllowGlobal directive is enabled for the catalog. So the headline 9.8 is a worst-case (AllowGlobal-enabled) figure; default-configuration impact is materially lower because the Safe sandbox limits opcodes/system access. Net: this is a genuine unauthenticated injection worth patching promptly, but the real-world 'total impact' claim is configuration-dependent and should be verified against the vendor advisory rather than taken at face value.

An unauthenticated attacker sends a crafted request to the Interchange admin 'quick question' feature (quick_question.html), supplying attacker-controlled input (e.g. the yes/no CGI parameters) that is reparsed and evaluated as server-side Perl via the [calc] tag. On a default catalog the code runs within the Safe compartment with constrained impact; if the catalog has the non-default AllowGlobal directive set, the same injection yields full server-side RCE. No public exploit code is identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.