CVE-2026-34977
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. This password is then directly passed into an expect command, which is then subsequently passed into a bash -c command, without any form of sanitization or validation. An unauthenticated attacker can achieve root-level RCE inside the worker container with a single HTTP request, enabling full read/write access to all user-uploaded images, analysis results, and plaintext steganography passwords stored on disk. Because the container shares a Docker network with PostgreSQL and Redis (no authentication on either), the attacker can pivot to dump the entire database or manipulate the job queue to poison results for other users. If Docker socket mounting or host volume mounts are present, this could escalate to full host compromise. This would also include defacement of the website itself. This vulnerability is fixed in 3.2.1.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA command injection vulnerability in Aperi'Solve versions 3.1.3-3.2.0 allows unauthenticated attackers to achieve root RCE by injecting shell commands through an optional password field during JPEG uploads. The password is passed unsanitized through an expect script into bash -c, enabling arbitrary command execution inside the worker container.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 3.2.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Aperi'Solve installationLocate the Aperi'Solve application directory or container. Check for the presence of aperisolve.py, Dockerfile, or the application web service.Affected if Aperi'Solve is present in the environment
-
Check installed versionReview the version.py file, git tags, or container image tag. Compare against the affected range 3.1.3-3.2.0.Affected if Version is 3.1.3, 3.1.4, 3.1.5, 3.2.0, or any version between 3.1.3 and 3.2.0 inclusive
-
Verify JPEG upload endpoint accessibilityAttempt to access the JPEG upload functionality without authentication. Check if the /upload or similar endpoint accepts requests from unauthenticated users.Affected if Unauthenticated access to JPEG upload is allowed
-
Inspect expect script usageLocate the expect script used during JPEG processing. Examine the code path where the password field is passed to the expect command and subsequently to bash -c.Affected if The password parameter from JPEG upload is passed unsanitized to an expect script that calls bash -c
-
Confirm worker container execution contextDetermine if the expect script runs inside a Docker container (worker container). Check if commands execute within containerized isolation rather than on the host.Affected if The vulnerable code executes within a container environment
The environment is affected if Aperi'Solve versions 3.1.3 through 3.2.0 are installed and the JPEG upload feature with the optional password field is accessible, allowing command injection through the expect script pathway.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to version 3.2.1 immediately to remediate the command injection. Additionally, implement Docker network isolation with authentication for PostgreSQL and Redis, avoid mounting Docker sockets or host volumes, and audit for plaintext password storage.
3.2.1
- Backup the current AperiSolve installation and any user data
- Stop the running AperiSolve services
- Pull the latest version from the AperiSolve GitHub repository
- Ensure the upgraded version is 3.2.1 or later which contains the fix
- Restart the AperiSolve services
- Verify the vulnerability is patched by testing JPEG upload functionality (do not use actual exploit code)
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-34977 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-34977 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data