{"id":"CVE-2026-82804","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82804","generatedAt":"2026-10-28T01:50:20.686Z","title":"The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.","description":"The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.\n\nAn authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.","published":"2026-09-29T13:17:53.000Z","lastModified":"2026-09-29T21:19:33.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":[],"epss":{"score":0.005,"percentile":0.42569,"date":"2026-10-26","history":[{"date":"2026-09-30","score":0.005,"percentile":0.4053}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-09-29T22:30:10.000Z","detail":{"from":null,"score":"8.8","severity":"HIGH","fromSeverity":null},"summary":"Now scored CVSS 8.8 HIGH."},{"kind":"new","label":"New CVE","at":"2026-09-29T13:17:53.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-09-29T13:17:52.843Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://lists.apache.org/thread.html/mwzbs5qdhs7nblfz70jgs0z54qx3phql","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/25","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82804","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}