Known vulnerabilities in Freecad

Vendor: Freecadweb
Software: Freecad
Software CPE: cpe:2.3:a:freecadweb:freecad:*:*:*:*:*:*:*:*
Website: https://github.com/FreeCAD/
Total vulnerabilities: 11
Public exploits: 5
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Freecad Freecad is affected by 11 known vulnerabilities: 8 high, 3 medium Critical High Medium Low

Vulnerabilities (11)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153055 - Uncontrolled Search Path Element
 CWE-427 Medium
No
No
 1.0.2 01.10.2026 SB2026100125
#VU153054 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 Medium
No
No
 1.1.4 01.10.2026 SB2026100124
#VU153053 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CWE-22 High
No
No
 1.1.4 01.10.2026 SB2026100124
#VU139917 - Improper input validation
CVE-2026-73233		 CWE-20 High
Available
No
 1.1.2 28.07.2026 SB20260728119
SB2026082731
#VU139904 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-73235		 CWE-611 Medium
Available
No
 1.1.2 28.07.2026 SB20260728119
SB2026082731
#VU139902 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-73234		 CWE-22 High
Available
No
 1.1.2 28.07.2026 SB20260728119
SB2026082731
#VU139901 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-34789		 CWE-94 High
Available
No
 1.1.2 28.07.2026 SB20260728119
SB2026082731
#VU139900 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-34399		 CWE-94 High
No
No
 1.1.1 28.07.2026 SB20260728117
SB2026082731
#VU139899 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-34398		 CWE-94 High
Available
No
 1.1.1 28.07.2026 SB20260728117
SB2026082731
#VU67353 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-45845		 CWE-78 High
No
No
 0.20 14.09.2022 SB2022091455
SB2022091456
#VU67352 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-45844		 CWE-78 High
No
No
 0.20 14.09.2022 SB2022091455
SB2022091456