What is GHSA-x2v3-fq4f-vvjj?

GHSA-x2v3-fq4f-vvjj is a security advisory published by GitHub Security Advisories with Critical severity. A filename supplied during file upload is not properly sanitized before being used in system...

Which CVE IDs does GHSA-x2v3-fq4f-vvjj cover?

GHSA-x2v3-fq4f-vvjj covers the following CVE IDs: CVE-2026-64879. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x2v3-fq4f-vvjj?

GHSA-x2v3-fq4f-vvjj has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

GHSA-x2v3-fq4f-vvjjCriticalCVSS 9.9

A filename supplied during file upload is not properly sanitized before being used in system...

Vendor

GitHub Security Advisories

Published

July 21, 2026

Last Modified

July 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-64879 →

📋 Description

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-64879
https://www.tenable.com/security/tns-2026-19
https://github.com/advisories/GHSA-x2v3-fq4f-vvjj