CVE-2026-34977

OVERVIEW CVE-2026-34977 affects Aperi'Solve, an open-source steganalysis web platform, in versions prior to 3.2.1. The vulnerability exists in the JPEG upload functionality where user-supplied passwords are passed directly into an expect command without sanitization or validation, enabling command injection attacks. SEVERITY This is a critical vulnerability with a CVSS score of 9.8, characterized by a network attack vector, low complexity, no privilege requirements, and no user interaction needed. An unauthenticated attacker can achieve root-level remote code execution within the worker container through a single HTTP request. The impact is severe, providing complete read and write access to all user-uploaded images, analysis results, and plaintext steganography passwords. The vulnerability also enables lateral movement to connected services including PostgreSQL and Redis, which lack authentication in typical deployments, potentially allowing database dumping and job queue manipulation. EXPLOITATION STATUS There is no indication of active exploitation in the wild, and this vulnerability does not appear on the Known Exploited Vulnerabilities list. The EPSS score of 0.0022 is relatively low, suggesting limited current exploit activity. However, given the simplicity of the exploitation method (a single HTTP request) and the critical nature of the vulnerability, organizations should prioritize patching to version 3.2.1 immediately rather than relying on low exploit probability as a mitigation strategy.