CVE-2026-34977 Details

A remote code execution vulnerability has been identified in Aperi'Solve versions prior to 3.2.1. This issue arises in the JPSeek analyzer, where an uploaded JPEG can be accompanied by a password. The password is directly injected into an expect command, which is then executed in a bash shell, without any sanitization or validation. This vulnerability allows an unauthenticated attacker to gain root access within the worker container, with a single HTTP request. Exploitation provides full read and write access to all user-uploaded images, analysis results, and plaintext steganography passwords stored on disk. Additionally, the container's shared Docker network with PostgreSQL and Redis (both without authentication) enables the attacker to dump the entire database or manipulate the job queue, potentially poisoning results for other users. If Docker socket mounting or host volume mounts are present, this could escalate to a full compromise of the host, including defacing the website.

Users can update to Aperi'Solve version 3.2.1 or later, where this vulnerability has been fixed.