CVE-2016-10320 textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.
HighCVSS 7.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| textract project textract | <= 1.4.0 | No fix listed |
References
- seclists.org exploit patch third-party-advisory vdb-entry