PT-2026-30676 · Redis+2 · Redis+3

Khaelk138 · Published 2026-04-06 · Updated 2026-04-09 · CVE-2026-34977

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aperi'Solve versions prior to 3.2.1

Description Aperi'Solve, an open-source steganalysis web platform, is susceptible to an unauthenticated remote code execution (RCE) vulnerability. When uploading a JPEG file, a user-provided password is directly incorporated into a bash command without proper sanitization or validation. This allows an attacker to achieve root-level RCE within the worker container, granting full read/write access to user-uploaded images, analysis results, and steganography passwords. The attacker can potentially pivot to dump the entire PostgreSQL database or manipulate the Redis job queue. If Docker socket mounting or host volume mounts are present, full host compromise is possible, including website defacement. The vulnerability affects the JPSeek analyzer functionality.

Recommendations Update to version 3.2.1 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34977

Affected Products

Aperisolve

Docker

Postgresql

Redis

References · 8

• 🔥 https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp · Exploit
• https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4 · Patch
• https://github.com/Zeecka/AperiSolve/pull/195 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34977 · Security Note
• https://github.com/Zeecka/AperiSolve/releases/tag/3.2.1 · Note
• https://twitter.com/praetorianlabs/status/2042351101404381219 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041194137676902508 · Twitter Post
• https://twitter.com/CVEnew/status/2041223978153296241 · Twitter Post