PT-2025-34107 · Unknown · Spree Commerce

Published 2025-08-20 · Updated 2025-08-20 · CVE-2011-10026

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spreecommerce versions prior to 0.50.x

Description The software contains a remote command execution issue in the API’s search functionality. Insufficient input validation allows attackers to inject arbitrary shell commands through the search[instance eval] parameter. This parameter is dynamically invoked using Ruby’s send method. This allows unauthenticated attackers to execute commands on the server.

Recommendations Update to version 0.50.x or later.

Exploit

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2011-10026

GHSA-X485-RHG3-CQR4

Affected Products

Spree Commerce

References · 10

• 🔥 https://exploit-db.com/exploits/17199 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_searchlogic_exec.rb · Exploit
• https://osv.dev/vulnerability/GHSA-x485-rhg3-cqr4 · Vendor Advisory
• https://web.archive.org/web/20111120023342/http://spreecommerce.com/blog/2011/04/19/security-fixes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-10026 · Security Note
• https://github.com/spree/spree · Note
• https://github.com/spree/spree/commit/3b559e7219f3681184be409ad00cd34a34a37978 · Note
• https://github.com/spree/spree/commit/0a9a360c590829d8a377ceae0cf997bbbbcc2df4 · Note
• https://vulncheck.com/advisories/spreecommerce-api-rce · Note
• https://github.com/spree · Note