Audit Upload Handler: Unsanitized Filenames Enable Cmd Injection
CVE-2026-64881 Published on July 21, 2026

Command Injection
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

NVD

Vulnerability Analysis

CVE-2026-64881 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2026-64881 has been classified to as a Shell injection vulnerability or weakness.


Products Associated with CVE-2026-64881

Want to know whenever a new CVE is published for Tenable Security Center? stack.watch will email you.

Tenable Security Center
 

Affected Versions

Tenable, Inc. Security Center: