CVE-2026-42796 - Vulnerability Analysis

Overview

Arelle < 2.39.10 contains a remote code execution caused by unauthenticated plugin URL input in /rest/configure endpoint, letting remote attackers execute arbitrary code with Arelle process privileges, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can execute arbitrary code with Arelle process privileges, potentially compromising the entire system.

Mitigation

Update to version 2.39.10 or later.

References

• https://github.com/Arelle/Arelle/pull/2320
• https://github.com/Arelle/Arelle/releases/tag/2.39.10
• https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner