EIP-2026-119452

PRE-CVE

WebSVN 2.3.2 - Unproper Metacharacters Escaping 'exec()' Remote Command Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-119452. PoCs published by rgod.

AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in WebSVN 2.3.2 due to improper escaping of metacharacters in the 'path' parameter, allowing remote command execution via the 'dl.php' script when 'allowDownload' is enabled.

Description

WebSVN 2.3.2 - Unproper Metacharacters Escaping 'exec()' Remote Command Injection

Exploits (1)

exploitdb WORKING POC VERIFIED
by rgod · textwebappswindows
https://www.exploit-db.com/exploits/17360

This exploit demonstrates a command injection vulnerability in WebSVN 2.3.2 due to improper escaping of metacharacters in the 'path' parameter, allowing remote command execution via the 'dl.php' script when 'allowDownload' is enabled.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WebSVN 2.3.2
No auth needed
Prerequisites: allowDownload option enabled in config.php · magic_quotes_gpc disabled
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026