PT-2026-30676 · Unknown+2 · Postgresql+3

Khaelk138 · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-34977

Positive Technologies · (AI Summary)

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Aperi'Solve versions prior to 3.2.1

Description Aperi'Solve is a steganalysis web platform. Before version 3.2.1, a password provided when uploading a JPEG is passed directly into an expect command and then a bash -c command without sanitization. This allows an unauthenticated attacker to achieve root-level remote code execution (RCE) within the worker container, granting full read/write access to user-uploaded images, analysis results, and steganography passwords. The container shares a Docker network with PostgreSQL and Redis, allowing the attacker to potentially dump the database or manipulate the job queue. Docker socket mounting or host volume mounts could lead to full host compromise, including website defacement.

Recommendations Update to version 3.2.1 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34977

Affected Products

Aperisolve

Docker

Postgresql

Redis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34977 · Security Note
• https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp · Note
• https://twitter.com/0dayPublishing/status/2041194137676902508 · Twitter Post
• https://github.com/Zeecka/AperiSolve/releases/tag/3.2.1 · Note
• https://github.com/Zeecka/AperiSolve/pull/195 · Note
• https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4 · Note