What is GHSA-4fc4-c4rx-qxh4?

GHSA-4fc4-c4rx-qxh4 is a security advisory published by GitHub Security Advisories with High severity. An authenticated OS command injection vulnerability exists in the Offline Download component (USB...

Which CVE IDs does GHSA-4fc4-c4rx-qxh4 cover?

GHSA-4fc4-c4rx-qxh4 covers the following CVE IDs: CVE-2026-118865. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-4fc4-c4rx-qxh4High

An authenticated OS command injection vulnerability exists in the Offline Download component (USB...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-118865 →

📋 Description

An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.

Successful exploitation may allow arbitrary command execution on the affected device.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-118865
https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware
https://www.tp-link.com/us/support/faq/5380
https://github.com/advisories/GHSA-4fc4-c4rx-qxh4