CVE-2011-10026

CVE-2011-10026 is a critical remote command execution vulnerability affecting Spreecommerce versions prior to 0.50.x. Attackers can exploit improper input sanitation in the API's search functionality, specifically the search[instance_eval] parameter, to inject and execute arbitrary shell commands on the server. This flaw carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low complexity, and complete compromise potential (confidentiality, integrity, availability). While not listed in CISA's KEV catalog, a Metasploit module exists, indicating readily available exploit code, though there is no evidence of active exploitation or significant community discussion.