Remote Code Execution Vulnerability in Aperi'Solve by Zeecka

CVE-2026-34977

What is CVE-2026-34977?

Aperi'Solve, an open-source steganalysis web platform, contains a serious vulnerability prior to version 3.2.1, where it fails to sanitize user-inputted passwords during JPEG uploads. This oversight allows an unauthenticated attacker to execute arbitrary commands with root privileges inside the worker container through a crafted HTTP request. As a result, all user-uploaded images and sensitive data can be accessed and manipulated. Furthermore, due to the platform's shared Docker network with PostgreSQL and Redis, attackers have the opportunity to compromise databases or disrupt job queues, leading to further exploitation of the system. This flaw underlines the importance of proper input validation and secure coding practices to prevent potential host compromises and website defacement.

References