CVE-2026-75031In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature.
Updated under an hour ago ()
Does this affect you?
It affects Interchange. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe container which limits the scope of what it can do, unless the non-default AllowGlobal directive is configured for the catalog being accessed.CTOR]
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-94
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat-cnalr
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Interchange Interchange interchange:interchange (from the name) | all versions | CNA record |
References
- https://www.interchangecommerce.org/i/dev/news?mv_arg=00071vendor-advisory
- https://github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.