SB2026100124 - Multiple vulnerabilities in Freecad

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files outside the intended transient directory.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in VRMLObject::restoreTextureFinished() when restoring VRML resources from a crafted FCStd document. A remote attacker can supply a crafted FCStd document containing traversal resource names to write arbitrary files outside the intended transient directory.

User interaction is required to open the crafted document.

2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in PropertyPostDataObject::RestoreDocFile() when extracting VTK multiblock data from a crafted .FCStd file. A remote attacker can trick the victim into opening a crafted .FCStd file to write arbitrary files.

The FEM module is automatically loaded when the document contains a Fem::FemPostPipeline object, so the FEM workbench does not need to be open.

Remediation

Install update from vendor's website.

References

• https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-9624-pf2m-8cgg
• https://github.com/FreeCAD/FreeCAD/commit/454a4b82cea22bec39755128a0a8f5014c730b72
• https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-9vjf-h8f4-c229