CVE-2026-42796

CRITICALNuclei

Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-42796 has a selected CVSS score of 9.2 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Arelle

Browse Arelle / Arelle

Default status: affected

CVE ListBefore 2.39.10affected

Proofs of concept

1

Repository PoCs

GitHubameerhamza-malik/CVE-2026-42796Repository PoCby ameerhamza-malik0Not analyzed1 file

98 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALArelle < 2.39.10 - Remote Code ExecutionCVSS 9.8

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code with the privileges of the Arelle webserver process, leading to full host compromise.

Remediation

Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.

WeaknessesCWE-306
Authorsaryu-ru
Template tagscvecve2026arellerceoastunauth
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shodan: http.html:"Arelle Web Services"
https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure https://github.com/Arelle/Arelle/pull/2320 https://github.com/Arelle/Arelle/releases/tag/2.39.10 https://nvd.nist.gov/vuln/detail/CVE-2026-42796

Source: ProjectDiscovery

References

4