PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73234 FreeCAD CVE debrief

A vulnerability in FreeCAD's PropertyFileIncluded::Restore() function allows for arbitrary file writing when a crafted .FCStd archive is opened. This issue is fixed in version 1.1.2. The vulnerability arises from the function's failure to properly validate file paths, allowing an attacker to write to arbitrary locations. FreeCAD users, administrators, and developers should assess exposure and prioritize upgrading to version 1.1.2 or later to mitigate potential risks. The vulnerability has a high severity score and could lead to persistence, credential compromise, configuration replacement, or code execution.

Vendor
FreeCAD
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-09-09
Advisory published
2026-08-11
Advisory updated
2026-09-09

Who should care

FreeCAD users, administrators, and developers should assess exposure and prioritize upgrading to version 1.1.2 or later. Additionally, operators, platform administrators, vulnerability management teams, and security teams may be impacted by this vulnerability and should take necessary precautions to mitigate potential risks.

Why it matters

CVE-2026-73234 is a high-severity vulnerability in FreeCAD that allows for arbitrary file writing when a crafted .FCStd archive is opened. FreeCAD users and administrators should prioritize upgrading to version 1.1.2 or later and verify the integrity of .FCStd archives before opening.

  • Potential persistence and credential compromise
  • Possible configuration replacement
  • Potential code execution via crafted .FCStd archives
  • Verification of FreeCAD version and .FCStd archive integrity

Technical summary

The PropertyFileIncluded::Restore() function in FreeCAD's src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can write attacker-controlled content to arbitrary locations accessible to the FreeCAD user.

Defensive priority

High

Recommended defensive actions

  • Upgrade to FreeCAD version 1.1.2 or later
  • Verify the integrity of .FCStd archives before opening
  • Monitor for suspicious activity related to FreeCAD usage
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify the exact versions affected or the number of victims. The vendor has released a fixed version (1.1.2) and provided source references for further information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73234 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73234

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73234 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73234

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.