Skip to content
Heist/ feed
High

Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET

Type: advisorySource: Official CVE List1 source record

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges could store manipulated arguments in the database and subsequently cause them to be processed by the revision comparison functionality. A successful exploit could allow the execution of arbitrary commands with the privileges of the account used by the application. To exploit this vulnerability, svn.exe must be installed and capable of being invoked by the service.

Announced Source revision 1
Original source ↗

CVE-2026-92531

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92531

BugTracker.NET

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "BugTracker.NET",
    "product": "BugTracker.NET",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-92531

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#11897 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement