{"id":"CVE-2026-7863","state":"PUBLISHED","title":"OS Command Injection in TUBITAK BILGEM's Pardus Software","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection.\n\nThis issue affects Pardus Software: before 1.0.5.","publishedAt":"2026-09-11T16:04:02.918Z","updatedAt":"2026-09-11T16:26:00.605Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"TR-CERT"},"assigner":"TR-CERT","products":["TUBITAK BILGEM Software Technologies Research Institute Pardus Software"],"affected":[{"vendor":"TUBITAK BILGEM Software Technologies Research Institute","product":"Pardus Software","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.5","versionType":"custom"}]}],"references":["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1080"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7863.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7863","state":"PUBLISHED","datePublished":"2026-09-11T16:04:02.918Z","dateUpdated":"2026-09-11T16:26:00.605Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2026-05-05T12:18:08.349Z"},"containers":{"cna":{"title":"OS Command Injection in TUBITAK BILGEM's Pardus Software","descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection.\n\nThis issue affects Pardus Software: before 1.0.5."}],"affected":[{"vendor":"TUBITAK BILGEM Software Technologies Research Institute","product":"Pardus Software","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.5","versionType":"custom"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1080","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.4,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-09-11T16:04:02.918Z"},"datePublic":"2026-09-11T15:59:00.000Z","impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"credits":[{"lang":"en","value":"Muhammed KAYA","type":"finder"}],"source":{"defect":["TR-26-1080"],"advisory":"TR-26-1080","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-11T16:22:42.579935Z","id":"CVE-2026-7863","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-11T16:26:00.605Z"}}]}}}