Junglewise Threat Intelligence

CVE-2026-75031: Interchange unauthenticated remote code execution in admin quick_question

CVE-2026-75031 · Severity: critical · CVSS 9.8 · Published 2026-09-18

Executive brief

Interchange is an open-source e-commerce application server used to build online stores. An unauthenticated attacker can inject and execute arbitrary Perl code on the server through the admin quick_question feature, leading to complete server compromise. In default installations, code runs in a restricted Safe container, but can break out with non-default configuration, allowing attackers to steal data, modify the store, or launch further attacks.

Technical details

A code injection vulnerability exists in the admin quick_question page that fails to sanitize user input, allowing arbitrary Perl code injection via the "no" parameter. The vulnerability is network-accessible without authentication. While default deployments run injected code within a Safe container, deployments with the AllowGlobal directive enabled allow unrestricted code execution with full server permissions.

Affected products

  • interchange Interchange

Timeline

  • 2026-08-08: disclosed
  • 2026-08-08: patched: Fix applied via commit 65b6ea9d3761dd1fd2071c962819562afa335e4e

References