CVE-2026-26002
criticalpriority · track · 39EPSS 0.006 · 46 %ileEUUSEPSS · scored 2026-10-28
Open OnDemand is an open-source high-performance computing portal. The Files application in OnDemand versions prior to 4.0.9 and 4.1.3 is susceptible to malicious input when navigating to a directory. This has been patched in versions 4.0.9 and 4.1.3. Versions below this remain susceptible.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.3–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/OSC/ondemand/commit/23cb167222886fdd8415277ca5c1215f4c32629ccnnvd
- https://github.com/OSC/ondemand/commit/37f0ae4efb222e9c0af250feae860a720427df16cnnvd
- https://github.com/OSC/ondemand/security/advisories/GHSA-f83q-mhrr-3cr2cnnvd
- https://www.openondemand.org/Patchcnnvd
- https://github.com/OSC/ondemand/commit/23cb167222886fdd8415277ca5c1215f4c32629cenisa_euvd
- https://github.com/OSC/ondemand/commit/37f0ae4efb222e9c0af250feae860a720427df16enisa_euvd
- https://github.com/OSC/ondemand/security/advisories/GHSA-f83q-mhrr-3cr2enisa_euvd
- https://github.com/OSC/ondemand/commit/23cb167222886fdd8415277ca5c1215f4c32629cPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan