CVE-2026-85672 in zerox
Summary
by MITRE • 09/04/2026
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The security flaw identified in zerox version 1.1.20 represents a critical server-side vulnerability rooted in improper neutralization of special elements used in an operating system command, commonly classified under CWE-78. This specific weakness manifests within the application's file download mechanism, where the software attempts to process documents by first determining their type based on the URL provided. The core technical failure lies in how the temporary filename is constructed for these downloads. Instead of sanitizing or validating the extension extracted from the document URL, the system directly interpolates this unsanitized value into shell commands that are subsequently executed by poppler utilities. This lack of input validation allows an attacker to inject arbitrary operating system command syntax directly into the execution context of the application's backend processes.
The operational impact of this vulnerability is severe, as it grants attackers the ability to execute arbitrary OS commands with the privileges of the user account running the zerox service. By crafting a document URL that includes malicious file extensions containing shell metacharacters or command substitution syntax, an adversary can bypass intended application logic and trigger system-level actions before the actual document processing begins. This could lead to complete compromise of the underlying server, including data exfiltration, installation of backdoors, lateral movement within the network, or denial of service through resource exhaustion. The use of poppler utilities for PDF rendering means that this vulnerability is particularly dangerous in environments where these tools are widely deployed and often run with elevated permissions to handle various document formats efficiently.
From a threat modeling perspective, this attack vector aligns closely with ATT&CK technique T1059, which covers Command and Scripting Interpreter abuse, specifically the sub-technique for shell commands such as sh or bash. The vulnerability allows an attacker to leverage standard system utilities to perform actions that are outside the scope of the application's intended functionality. Because the injection occurs during the initial phase of document handling, it effectively bypasses any subsequent security controls that might be applied after file processing begins. This early-stage execution point makes detection difficult for traditional intrusion prevention systems that may not inspect internal command-line arguments or temporary file creation processes in real-time.
Mitigation strategies must focus on strict input validation and secure coding practices regarding system command invocation. The most effective remediation is to eliminate the use of shell interpreters entirely when invoking external utilities like poppler. Developers should refactor the code to call these programs directly using application-level APIs or library functions that do not pass through a shell, thereby preventing any injected metacharacters from being interpreted as commands. If shell invocation remains necessary for legacy reasons, all user-supplied input must be rigorously sanitized against a whitelist of allowed characters and extensions before being used in command construction. Additionally, implementing principle of least privilege by running the zerox service with minimal required permissions can limit the blast radius if an exploitation attempt succeeds. Regular security audits and static code analysis tools configured to detect CWE-78 patterns are also recommended to identify similar flaws across the codebase.