FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4815 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4815-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     October 03, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : freecad     Version        : 0.20.2+dfsg1-4+deb12u1     CVE ID         : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235     Debian Bug     : 1144349

    Three vulnerabilities were discovered in FreeCAD, an open-source     multiplatform 3D parametric modeler, which could result in arbitrary     code execution, arbitrary file writes, and the disclosure of local files     or triggering of remote network requests.

    CVE-2026-34789

        When restoring a crafted FCStd document, FreeCAD passed an         attacker-controlled module name to the Python interpreter and thereby         executed code contained in the imported module. An attacker could         execute arbitrary Python code with the privileges of the FreeCAD user.

    CVE-2026-73234

        When restoring a crafted FCStd document, FreeCAD used         attacker-controlled file paths without properly restricting directory         traversal or absolute paths. An attacker could write arbitrary         content to files accessible to the FreeCAD user, potentially         allowing persistence or code execution.

    CVE-2026-73235

        When restoring a crafted FCStd document, FreeCAD processed XML external         entities without disabling external entity or DTD resolution. An         attacker could read local files or cause requests to be made to         remote servers.

    For Debian 12 bookworm, these problems have been fixed in version     0.20.2+dfsg1-4+deb12u1.

    We recommend that you upgrade your freecad packages.

    For the detailed security status of freecad please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/freecad

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6467 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6467-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 26, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : freecad     CVE ID         : CVE-2026-34398 CVE-2026-34399 CVE-2026-34789 CVE-2026-73233                      CVE-2026-73234 CVE-2026-73235     Debian Bug     : 1144349

    Multiple vulnerabilities were discovered in FreeCAD, a parametric 3D CAD     modeller, which may result in the execution of arbitrary code, the     disclosure of local files or requests to arbitrary hosts when a crafted     FCStd document or template is processed.

    For the stable distribution (trixie), these problems have been fixed in     version 1.0.0+dfsg-8+deb13u3.

    We recommend that you upgrade your freecad packages.

    For the detailed security status of freecad please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/freecad

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2,     PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or     data attribute from Document.xml with the document transient path without rejecting directory components,     absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute     and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the     FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code     execution. This issue is fixed in version 1.1.2. (CVE-2026-73234)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362867	Debian dla-4815 : freecad - security update	Nessus	Debian Local Security Checks	Local	high
339657	Debian dsa-6467 : freecad - security update	Nessus	Debian Local Security Checks	Local	high
334893	Linux Distros Unpatched Vulnerability : CVE-2026-73234	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-73234

high

Tenable Plugins

high

high

high