CVE-2025-69600

Name of the Vulnerable Software and Affected Versions RayVentory Scan Engine versions prior to 12.6 Update 8

Description Command injection occurs due to an incorrectly constructed find command query. The application searches for a Java executable using search criteria that is not properly terminated or sanitized. A local attacker can create a crafted directory structure and path to trick the application into executing arbitrary Java code. This issue is triggered via the 'getconfig', 'upload', 'inventory', and 'oracle' options. Specifically, the 'upload' option is affected through the URL argument, and the 'oracle' option is affected through the -o flag.

Recommendations Update to a version later than 12.6 Update 8.