Executive brief
WebMap is a network scanning tool that integrates Nmap functionality for security assessments. An unauthenticated attacker can inject arbitrary operating system commands through the Nmap scan handler, potentially executing code with the privileges of the application and compromising the underlying server.
Technical details
This vulnerability is an OS command injection flaw in the nmap_newscan function within functions_nmap.py of the New Nmap Scan Handler component. The vulnerability stems from insufficient input validation on the target/params argument, allowing an attacker to inject shell commands that are executed on the server. The attack is network-accessible and does not require authentication. Successful exploitation allows remote code execution with the privileges of the WebMap process. A patch (commit 3d52f65803a2716bff14d938352c6fef45b0cfb6) has been released and publicly disclosed.
Affected products
- SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25
Timeline
- 2026-09-15: disclosed: Publicly disclosed vulnerability
- 2026-09-15: patched: Fix applied via silent patch (commit 3d52f65803a2716bff14d938352c6fef45b0cfb6)