CVE-2026-85439
MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname
Published Sep 3, 2026 · updated Oct 14, 2026 · moos-ivp moos-ivp
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 3, 2026 · NIST NVD
Detected
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
Oct 14, 2026 · NIST NVD
Updated
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
Affected
- cpe mit/moos-ivpversion unspecified
- vendor moos-ivp moos-ivpversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-85439
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to ex
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-85439
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-85439
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2026-85439
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to ex
nvd.nist.gov