Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authenticati…
CVSS 4.0CRITICAL 9.2·Network·No auth·No interaction·EPSS 0.02747·Published 2026-05-04·Fixed in 2.39.10CWE-306