CVE-2016-10320

2017-04-0618:00:00

mitre

www.cve.org

textract

os command injection

cve-2016-10320

web application

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

41.4%

JSON

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.

References

seclists.org/oss-sec/2016/q4/442