CVE-2026-73235 – FreeCAD
“Crafted FreeCAD files can cross filesystem boundaries, expose sensitive data, or execute attacker-controlled code.”
FreeCAD versions before 1.1.2 are affected by three vulnerabilities involving path traversal, XML external entities, and code injection. CVE-2026-73233 has a CVSS score of 8.5, High severity and can execute arbitrary Python code with the FreeCAD process's privileges through crafted FEM displacement formulas. CVE-2026-73234 has a CVSS score of 7.8, High severity and can write attacker-controlled content to arbitrary locations accessible to the FreeCAD user. Public proof-of-concept information is available for both vulnerabilities.
CVE-2026-73235 has a CVSS score of 6.1, Medium severity and can allow crafted FreeCAD documents to read local files or initiate network requests through unsafe external XML entity processing. These vulnerabilities are fixed in FreeCAD 1.1.2.
Key Details
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-611