Executive brief
Aperi'Solve is an open-source platform used for analyzing hidden data within images. A security flaw allows an attacker to take full control of the server by simply uploading a JPEG image with a specially crafted password. This could lead to the theft of user-uploaded images, exposure of private passwords, and potential access to the underlying database or the entire hosting server.
Technical details
A command injection vulnerability exists in the `jpseek` analyzer component of Aperi'Solve. The application takes a user-provided password and interpolates it directly into an `expect` command string, which is then executed via `bash -c` without sanitization. An unauthenticated remote attacker can exploit this by uploading a JPEG and providing a password containing shell metacharacters (e.g., `; command ;`). This results in root-level RCE within the worker container. Because the container environment lacks authentication for its Redis and PostgreSQL instances, an attacker can pivot to dump databases or manipulate job queues. The issue is resolved in version 3.2.1 by removing the shell wrapper and passing the password via an environment variable.
Affected products
- Zeecka AperiSolve 3.1.3 - 3.2.0
Timeline
- 2026-01-13: other: Vulnerable jpseek analyzer introduced in PR #173
- 2026-03-30: patched: Fix merged in PR #195
- 2026-04-06: advisory: CVE-2026-34977 published
References
- https://github.com/Zeecka/AperiSolve/blob/9fc388c629f86221bf2a265559eba5650d39fc29/aperisolve/analyzers/jpseek.py
- https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4
- https://github.com/Zeecka/AperiSolve/pull/173
- https://github.com/Zeecka/AperiSolve/pull/195
- https://github.com/Zeecka/AperiSolve/releases/tag/3.1.3
- https://github.com/Zeecka/AperiSolve/releases/tag/3.2.1
- https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp