Live › vulnerability › CVE-2026-38595
im3x Scriptables through the v2-dev branch fails to sanitize filenames on uploads to its /sync endpoint. An attacker who uploads a file with a crafted name can inject operating system commands that run on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Deployments of im3x Scriptables built from the v2-dev branch that expose the /sync upload endpoint. The sources do not name a patched version or say whether released versions are affected.
No product ranges from the sources yet.
git branch in the install directory, or the deployed package version)No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-38595")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.