CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

SummaryThe FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. DetailsThe FileCatalog...

PT-2026-64075

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...

GHSA-M4M7-4CW8-62J6 DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution...

PT-2026-57976

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.79 DIRAC versions prior to 9.0.22 DIRAC versions prior to 9.1.10 Description An authenticated user can achieve remote code execution on the server due to a flaw in the FileCatalog DatasetManager. The checkDataset...