Uncontrolled Search Path Vulnerability in Chaos Software V-Ray
CVE-2026-104989

9.3CRITICAL

Key Information:

Vendor

Chaos Software

Status
V-ray Swarm
Vendor
CVE Published:
9 November 2026

What is CVE-2026-104989?

An uncontrolled search path flaw in the package upload feature of Chaos Software V-Ray versions up to 2.0.19 allows remote unauthenticated attackers to execute arbitrary code. This security gap enables attackers to manipulate access to libraries, posing significant risks to the integrity and confidentiality of the system.

Affected Version(s)

V-Ray Swarm 0 <= 2.0.19

References

https://github.com/mandiant/Vulnerability-Disclosures/blo...
third-party-advisory
https://documentation.chaos.com/space/VRAYSWARM/143081472...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.