PT-2026-23070 · Unknown · Open Ondemand

Iratechiapet · CVE-2026-26002 · Published 2026-03-04 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.0.9 Open OnDemand versions prior to 4.1.3

Description The Files application in Open OnDemand is susceptible to malicious input when navigating to a directory. This issue affects installations prior to versions 4.0.9 and 4.1.3.

Recommendations Update to Open OnDemand version 4.0.9 or later. Update to Open OnDemand version 4.1.3 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-26002

GHSA-F83Q-MHRR-3CR2

Affected Products

Open Ondemand

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26002.json · Exploit
• https://github.com/OSC/ondemand/commit/37f0ae4efb222e9c0af250feae860a720427df16 · Patch
• https://github.com/OSC/ondemand/security/advisories/GHSA-f83q-mhrr-3cr2 · Vendor Advisory
• https://github.com/OSC/ondemand/commit/23cb167222886fdd8415277ca5c1215f4c32629c · Patch
• https://osv.dev/vulnerability/CVE-2026-26002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26002 · Security Note
• https://twitter.com/infoflowcloud/status/2029340032985694372 · Twitter Post
• https://t.me/CVEtracker/46382 · Telegram Post
• https://t.me/cveNotify/154233 · Telegram Post
• https://twitter.com/CVEnew/status/2029339227071357396 · Twitter Post