{"id":"CVE-2026-92531","state":"PUBLISHED","title":"Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET","description":"Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges could store manipulated arguments in the database and subsequently cause them to be processed by the revision comparison functionality. A successful exploit could allow the execution of arbitrary commands with the privileges of the account used by the application. To exploit this vulnerability, svn.exe must be installed and capable of being invoked by the service.","publishedAt":"2026-10-07T10:48:41.717Z","updatedAt":"2026-10-07T14:52:05.056Z","severity":{"score":7.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["BugTracker.NET BugTracker.NET"],"affected":[{"vendor":"BugTracker.NET","product":"BugTracker.NET","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bugtrackernet"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92531.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92531","state":"PUBLISHED","datePublished":"2026-10-07T10:48:41.717Z","dateUpdated":"2026-10-07T14:52:05.056Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2026-09-16T12:40:29.686Z"},"containers":{"cna":{"title":"Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET","descriptions":[{"lang":"en","value":"Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges could store manipulated arguments in the database and subsequently cause them to be processed by the revision comparison functionality. A successful exploit could allow the execution of arbitrary commands with the privileges of the account used by the application. To exploit this vulnerability, svn.exe must be installed and capable of being invoked by the service."}],"affected":[{"vendor":"BugTracker.NET","product":"BugTracker.NET","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bugtrackernet"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2026-10-07T10:48:41.717Z"},"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bugtracker.net:bugtracker.net:all_versions:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Álvaro Monforte de la Huerga","type":"finder"},{"lang":"en","value":"Juan Gabriel Ruiz Fernández","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-07T14:51:53.170014Z","id":"CVE-2026-92531","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-07T14:52:05.056Z"}}]}}}