-------------------------------------------------------------------------
Debian LTS Advisory DLA-4815-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Tobias Frost
October 03, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : freecad
Version : 0.20.2+dfsg1-4+deb12u1
CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235
Debian Bug : 1144349
Three vulnerabilities were discovered in FreeCAD, an open-source
multiplatform 3D parametric modeler, which could result in arbitrary
code execution, arbitrary file writes, and the disclosure of local files
or triggering of remote network requests.
CVE-2026-34789
When restoring a crafted FCStd document, FreeCAD passed an
attacker-controlled module name to the Python interpreter and thereby
executed code contained in the imported module. An attacker could
execute arbitrary Python code with the privileges of the FreeCAD user.
CVE-2026-73234
When restoring a crafted FCStd document, FreeCAD used
attacker-controlled file paths without properly restricting directory
traversal or absolute paths. An attacker could write arbitrary
content to files accessible to the FreeCAD user, potentially
allowing persistence or code execution.
CVE-2026-73235
When restoring a crafted FCStd document, FreeCAD processed XML external
entities without disabling external entity or DTD resolution. An
attacker could read local files or cause requests to be made to
remote servers.
For Debian 12 bookworm, these problems have been fixed in version
0.20.2+dfsg1-4+deb12u1.
We recommend that you upgrade your freecad packages.
For the detailed security status of freecad please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/freecad
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature