Source: freecad Version: 1.1.1+dfsg-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for freecad. CVE-2026-73233[0]: | FreeCAD is a free and open-source multiplatform 3D parametric | modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog | in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the | xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula | fields of a Fem::ConstraintDisplacement object through | TaskDlgFemConstraintDisplacement::accept() into | Gui::Command::doCommand. The escaping helper neutralizes quotation | marks but not backslashes, allowing crafted formula text to | terminate the generated Python string and execute arbitrary Python | code with the FreeCAD process's privileges when a victim accepts the | dialog. This issue is fixed in version 1.1.2. CVE-2026-73234[1]: | FreeCAD is a free and open-source multiplatform 3D parametric | modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in | src/App/PropertyFile.cpp concatenates an attacker-controlled file or | data attribute from Document.xml with the document transient path | without rejecting directory components, absolute paths, or parent | traversal. A crafted .FCStd archive with a matching FileIncluded XML | attribute and ZIP entry can therefore write attacker-controlled | content to arbitrary locations accessible to the FreeCAD user, | potentially enabling persistence, credential compromise, | configuration replacement, or code execution. This issue is fixed in | version 1.1.2. CVE-2026-73235[2]: | FreeCAD is a free and open-source multiplatform 3D parametric | modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in | src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker- | controlled Document.xml from a crafted .FCStd archive without | disabling default external entity resolution or external DTD | loading. When Document::restore() opens the document, external | entities can read local files through the file URI scheme or | initiate server-side requests through the http URI scheme, and | resolved content can flow through the characters() callback. This | issue is fixed in version 1.1.2. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73233 https://www.cve.org/CVERecord?id=CVE-2026-73233 [1] https://security-tracker.debian.org/tracker/CVE-2026-73234 https://www.cve.org/CVERecord?id=CVE-2026-73234 [2] https://security-tracker.debian.org/tracker/CVE-2026-73235 https://www.cve.org/CVERecord?id=CVE-2026-73235 Regards, Salvatore
