TI-2026-74141 CVE-2026-110647 · GHSA-f273-crjh-xp28OS command injection in Turnpress via crafted .docx file namesPriority MEDIUM 41Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.CVSS 4.0HIGH 8.5· Local · No auth · User interaction · EPSS 0.01037 · Published 2026-10-14 · No fix listed CWE-78