Read the docs
TI-2017-06310 Aliases CVE-2017-8799GHSA-7525-8gp9-2r6f

Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1…

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. To exploit this vulnerability, a virtual iRODS pathname that includes a semicolon would be retrieved via igetwild. Because igetwild is a Bash script, the part of the pathname following the semicolon would be executed in the user's shell.

Why it matters now

EPSS 0.02092 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:irods:irods:*:*:*:*:*:*:*:*up to 4.1.10VulnerableIrods
cpe:2.3:a:irods:irods:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableIrods
  • cpe:2.3:a:irods:irods:*:*:*:*:*:*:*:* Versions up to 4.1.10 Vulnerable ·Irods
  • cpe:2.3:a:irods:irods:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Irods

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-8799
  2. 2026-10-03 Alias added: GHSA-7525-8gp9-2r6f

References

Patch 1

  • TI-2024-25705 iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the… CVSS 3.1CRITICAL 9.8
  • TI-2012-04920 Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors. CVSS 2.0HIGH 10.0
  • TI-2024-25704 irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences