CVE-2026-2956 is a critical command injection vulnerability affecting qinming99 dst-admin up to version 1.5.0, specifically within the revertBackup function in the /home/restore file when manipulating the 'Name' argument. This flaw carries a CVSS v3.1 score of 8.8 (High), indicating that it can be exploited remotely with low attack complexity, leading to high impact on confidentiality, integrity, and availability. While an exploit has been publicly released, there is currently no evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.5.0CPE matchmatch criteria | cpe:2.3:a:dst-admin_project:dst-admin:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.