Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.2epss 2.7%
from disclosure to weapon4 days
Published on NVDMay 4
1st PoC+4d
exploitation probability
2.7%top 15% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Arelle · Arellepublic PoCs found — 1
githubgithub.com/ameerhamza-malik/CVE-2026-42796★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.