CRITICAL 9.3 NVD

CVE-2026-104989

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute ar

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

References

https://documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md

Published: 2026-11-09 · Source: NVD · Feed updated: 2026-11-10

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-09 via NVD.

Risk Timeline

CVE Disclosed2026-11-09 · 0 days ago

Remediation Resources

GitHub

github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-20

Analysis & PoC

documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21

vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.