CVE-2026-75031CWE-94code-injection

CVE-2026-75031

Critical · published September 18, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the

“quick question” admin feature. In default installations arbitrary Perl

code can be injected and executed server-side by unauthenticated users.

The Perl code normally runs within a Safe container which limits the

scope of what it can do, unless the non-default AllowGlobal directive is

configured for the catalog being accessed.CTOR]

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-18T20:17Z
References (2)
https://github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4e · 74b3a70d-cca6-4d34-9789-e83b222ae3behttps://www.interchangecommerce.org/i/dev/news?mv_arg=00071 · 74b3a70d-cca6-4d34-9789-e83b222ae3be
EPSS history
Timeline
  • 20 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 18 SEP 15:20Z
    In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature
    cvelistv5