CVE-2016-10320

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2017-04-06

Last modified

2024-09-16

Weaknesses

CWE-78

Affected products

• Textract (Textract Project)

References

• http://seclists.org/oss-sec/2016/q4/442