PT-2026-36887 · Arelle · Arelle

Published 2026-05-04 · Updated 2026-05-27 · CVE-2026-42796

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arelle versions prior to 2.39.10

Description An unauthenticated remote code execution issue exists in the '/rest/configure' REST endpoint. The endpoint accepts a plugins query parameter and forwards it to the plugin manager without requiring authentication or authorization. This allows an attacker to provide a URL to a malicious Python file via the plugins parameter, leading the Arelle webserver to download and execute the attacker-controlled code with the privileges of the Arelle process.

Recommendations Update to version 2.39.10. As a temporary workaround, restrict access to the '/rest/configure' endpoint to minimize the risk of exploitation.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-42796

Affected Products

Arelle

References · 14

• https://github.com/Arelle/Arelle/pull/2320 · Patch
• https://github.com/Arelle/Arelle/releases/tag/2.39.10 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42796 · Security Note
• https://twitter.com/VulmonFeeds/status/2051372934409666671 · Twitter Post
• https://twitter.com/CVEnew/status/2051361262882152867 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054479513883480107 · Twitter Post
• https://t.me/cveNotify/164899 · Telegram Post
• https://twitter.com/OrizonCyber/status/2051368795550187528 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054479516639043777 · Twitter Post
• https://vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure · Note
• https://t.me/CVEtracker/52649 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054479514776846826 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051417237894955440 · Twitter Post
• https://twitter.com/integ_sec/status/2055623044626776443 · Twitter Post