PT-2026-76779 · Freecad · Freecad

CVE-2026-34398

·

Published

2026-08-17

·

Updated

2026-08-19

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0
Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to the eval() function. This allows for arbitrary Python code execution when a user loads a malicious BIM project template.
Recommendations Update to version 1.1.1.

Exploit

Fix

Eval Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-34398
GHSA-8RFJ-7956-6GWF

Affected Products

Freecad