GCVE-1988-2026-0116

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext / \nGraphwise). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nOntotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter \nchain. As a result, /rest/repositories/ruleset/upload and /repositories/* are anonymously reachable. A .pie ruleset \nupload is compiled at runtime by the system javac and loaded into the server process. RuleCompilerBase.compilePrefices \ninlines the namespace prefix verbatim into the generated Java source with only .trim() and no validation. An attacker \ninjects Java code in the prefix; creating a graphdb:Sail repository triggers infer.initialize(), which executes the \ninjected Runtime.exec as the GraphDB process user (root). No authentication and no license are required. Dynamically \nverified with uid=0(root).\n\nImpact: Full host compromise as root (the GraphDB process user); the attacker can read any file, execute arbitrary \ncommands, and take full control of the GraphDB host and its repositories.\n\nAdvisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/53"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/53"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0116",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53",
            "automated": true,
            "contentSha256": "d1819df0ca4a56f1374c818730f46e330e087eab2119aa5cb776a0327e2b620d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/53",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0116"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}