CVE-2026-107780

Summary

The vulnerability allows attackers to inject OS commands via the format parameter, leading to potential command execution as the Skyeye service account.

Exploitability

Exploitation is relatively straightforward as it requires only injecting a single quote into the format parameter. The unauthenticated nature of the endpoint makes it accessible to any attacker.

Blast radius

If exploited, this could result in full compromise of the affected system, including data theft, service disruption, and potential lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the specific version 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.