Executive brief
A file-transfer interface in a system used across energy, water, and IT infrastructure sectors accepts file uploads with names containing shell metacharacters without validation. An automated background process constructs and executes system commands using these filenames, allowing authenticated users to inject arbitrary operating system commands. Successful exploitation could enable attackers to read and modify security logs, manipulate audit trails, and establish a foothold for further attacks within internal networks.
Technical details
This vulnerability is a command injection flaw in a file-transfer interface component. The vulnerable code accepts user-supplied filenames from authenticated file uploads without sanitizing shell metacharacters (e.g., `;`, `|`, backticks, `$()`, etc.). A backend automated process subsequently constructs and executes system commands that incorporate the uploaded filename, allowing injection of arbitrary OS commands. The attack requires valid credentials to upload files, but no additional user interaction is needed once the file is uploaded. An attacker can execute commands with the privileges of the automated process—potentially reading/modifying ingested log data and facilitating lateral movement within the internal network. Patches or fixes are not mentioned in the advisory.
Timeline
- 2026-09-11: disclosed: CVE-2026-90444 published via NVD and CISA advisory ICSA-26-254-01