Is CVE-2026-107780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107780 being exploited in the wild.

How severe is CVE-2026-107780?

Critical severity, with a CVSS score of 9.8, published 8 October 2026.

Which products and versions are affected?

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

Is there a fix for CVE-2026-107780?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107780 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107780?

Check whether you run Dromara Skyeye at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107780: Dromara Skyeye OS command injection in TTS endpoint

CVE-2026-107780 · Severity: critical · CVSS 9.8 · Published 2026-10-08

Dromara Skyeye is an intelligent office management system used by hospitals, schools, and enterprises. The application contains an unauthenticated command injection vulnerability in its text-to-speech feature that allows attackers to execute arbitrary operating system commands with the privileges of the Skyeye service account.

Technologies: Dromara Skyeye. Vendors: Dromara.

Quick answers

Is CVE-2026-107780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107780 being exploited in the wild.
How severe is CVE-2026-107780?: Critical severity, with a CVSS score of 9.8, published 8 October 2026.
Which products and versions are affected?: Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
Is there a fix for CVE-2026-107780?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107780 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107780?: Check whether you run Dromara Skyeye at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the unauthenticated /post/TtsController/textToSpeech endpoint where the format parameter is passed unsanitized to PowerShell on Windows systems. An attacker can inject a single quote character to break out of the PowerShell string context and execute arbitrary commands as the service account. The vulnerability is reachable without authentication and requires only network access to the application.

Affected products

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.