TI-2026-58784 CVE-2026-85672 · GHSA-ppx5-774h-49hh
zerox 1.1.20 OS Command Injection via Document URL File Extension
Priority HIGH 81
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler…