PT-2025-34107 · Unknown · Spree Commerce

CVE-2011-10026 · Published 2025-08-20 · Updated 2025-08-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spreecommerce versions prior to 0.50.x

Description The software contains a remote command execution issue in the API’s search functionality. Insufficient input validation allows attackers to inject arbitrary shell commands through the search[instance eval] parameter. This parameter is dynamically invoked using Ruby’s send method. This allows unauthenticated attackers to execute commands on the server.

Recommendations Update to version 0.50.x or later.

Exploit

Fix

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

CVE-2011-10026

GHSA-X485-RHG3-CQR4

Affected Products

Spree Commerce

References · 10

• 🔥 https://exploit-db.com/exploits/17199 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_searchlogic_exec.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-10026 · Security Note
• https://web.archive.org/web/20111120023342/http://spreecommerce.com/blog/2011/04/19/security-fixes · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x485-rhg3-cqr4 · Vendor Advisory
• https://github.com/spree/spree · Note
• https://github.com/spree/spree/commit/3b559e7219f3681184be409ad00cd34a34a37978 · Note
• https://github.com/spree/spree/commit/0a9a360c590829d8a377ceae0cf997bbbbcc2df4 · Note
• https://vulncheck.com/advisories/spreecommerce-api-rce · Note
• https://github.com/spree · Note