SHIRASAGI · CVE-2026-118869 · Other
FIX → 1.21.1 ✓ verified
SHIRASAGI (Japanese open-source CMS) v1.19.0 to v1.21.0 passes the harvest import 'URL' field of an Open Data dataset to an OS command. A logged-in user with permission to manage Open Data datasets and harvest imports can run arbitrary commands on the server (vendor's example: URL set to '|touch /tmp/hacked', then click 'Import dataset'). Fixed in v1.21.1. No exploitation in the wild reported.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted SHIRASAGI sites running v1.19.0 to v1.21.0 that have Open Data configured. The attacker needs a login with permission to manage Open Data datasets and their harvest imports; they then enter a shell payload in the harvest import URL and run the import, executing commands as the web application on the server. v1.18.2 and earlier, v1.21.1 and later, and sites without Open Data or without such accounts can skip it.
Not affected if auth-required, no-shirasagi-install, open-data-not-configured, version-1.18.2-or-earlier
Who cares cms, command-injection, open-data, self-hosted, shirasagi
v1.19.0 through v1.21.0v1.18.2 and earlier (no harvest feature or a safe implementation) and v1.21.1 or laterAn OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.21.1
Upgrade SHIRASAGI to v1.21.1, or apply upstream commit 98eca87586f4a6f74114fdfa7a6b88d3e49af029 (https://github.com/shirasagi/shirasagi/commit/98eca87586f4a6f74114fdfa7a6b88d3e49af029).