Homepage

Directory Traversal Affecting freecad package, versions <1.1.3+dfsg-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.24% (14th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-FREECAD-18674883
  • published12 Aug 2026
  • disclosed11 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 11 Aug 2026

CVE-2026-73234  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Debian:unstable freecad to version 1.1.3+dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freecad package and not the freecad package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.