CVE-2026-73234

HIGH 7.8

FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.

CWE	CWE-22
Vendor	freecad
Product	freecad
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for freecad freecad

Be the first to know when new high vulnerabilities affecting freecad freecad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FreeCAD / FreeCAD

< 1.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-5vqh-3v38-jw2r github.com: https://github.com/FreeCAD/FreeCAD/pull/31269 github.com: https://github.com/FreeCAD/FreeCAD/pull/31281 github.com: https://github.com/FreeCAD/FreeCAD/commit/7cabda0979779251bad516cb6911a43dc03c5203 github.com: https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d github.com: https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2