CVE-2026-34977 is a critical command injection in Aperi'Solve, an open source steganalysis web platform. NVD scores it 9.8. In versions 3.1.3 through 3.2.0, the optional JPEG password reaches a shell without sanitizing. Update to a build that includes the fix.
What's affected
Aperi'Solve 3.1.3 through 3.2.0.
The record points to a commit and pull request 173 as the fix and does not name a release number. Check the project's releases page for the first release that contains it before you decide which version to deploy.
How to check if you're exposed
Check which version or commit your deployment runs. If you run the Docker images, read the image tag or build date, and compare against the fix commit in the project repository.
If your instance is reachable from the internet, treat it as high priority. The record says no authentication is needed.
What to do now
- Update to a release that contains the fix from pull request 173, or rebuild from a commit that includes it.
- If you cannot update, take the instance off the public internet or put authentication in front of it.
- Review what is stored on the instance. The record says uploaded images, results and passwords are on disk.
- Check the worker container's network and mounts. The record warns about the shared Docker network, unauthenticated PostgreSQL and Redis, and Docker socket or host volume mounts.
Why it matters
The weakness is CWE-78, OS command injection. The password field went into an expect command that was passed to bash with its command string option, with no validation. That chain turned a text field into a way to run commands.
The record describes root level access inside the worker container from one HTTP request. It also points out that the surrounding setup can make things worse: databases without authentication on a shared network, and any mounted Docker socket.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What if I only run it locally?
The risk drops if nobody else can reach it, but update anyway. Anything that can reach the web port can send the request.
Should I rotate anything?
If the instance was exposed, treat stored passwords and anything in mounted volumes as exposed, and rebuild the containers from a patched source.
Sources
Last reviewed: 19 October 2026.
