CVE-2026-85672 — zerox 1.1.20 OS Command Injection via Document URL File Extension
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsaniti…
Published: 2026-09-04 · CVSS: 9.3 · CVSS 4.0
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7