BugTracker.NET EUVD-2026-94283

Exploitation requires an authenticated account with administrator privileges (CVSS PR:H) that can write to the SVN repository configuration field, and the SVN integration component must be in use. Critically, svn.exe must be installed on the host and invokable by the service account (reflected as AT:P in the vendor vector); on deployments without SVN integration or without svn.exe present, the vulnerable revision-comparison code path cannot be triggered. The payload is stored in the database first and only executes when the revision-comparison functionality is subsequently invoked. These factors - required admin authentication, dependence on the optional SVN integration, and the external svn.exe dependency - substantially limit realistic exploitation despite the network attack vector.

This is a genuine but constrained risk rather than a widespread emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, score 7.5) shows that while the attack is network-reachable through the web application, it requires PR:H - authenticated administrator privileges - which sharply limits the realistic attacker population to insiders or an adversary who has already compromised an admin account. The AT:P flag further signals a non-default attack requirement: svn.exe must be installed and invokable by the service. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Contrast the signals: the HIGH technical impact (VC:H/VI:H/VA:H - arbitrary command execution as the service account) pulls risk upward, while the PR:H prerequisite and the svn.exe/SVN-integration dependency pull real-world exploitability downward. SSVC-style framing would likely place this as exploitation=none, automatable=no (privileged, config-dependent, no scope change), technical impact=total. Net: a real priority for organizations that both run BugTracker.NET with SVN integration AND treat admin-to-OS privilege escalation as in-scope, but low urgency for the general population. Note the primary data gap: a single vendor/CERT reference (INCIBE) with no NVD CVSS 3.1 vector, no EPSS, and no affected-version range - affected versions are only implied by a wildcard CPE.

An authenticated administrator (or an attacker who has phished or hijacked an admin session) edits a project's SVN repository configuration field, embedding malicious OS command arguments that are stored in the database. When the revision-comparison feature later invokes svn.exe with that unvalidated value, the injected commands execute with the privileges of the BugTracker.NET service account. No public exploit code is identified at time of analysis, but the injection path is straightforward to reproduce given admin access.