CVE-2026-73234: FreeCAD Path Traversal Vulnerability

CVE-2026-73234 Overview

CVE-2026-73234 is a path traversal vulnerability [CWE-22] in FreeCAD, the free and open-source multiplatform 3D parametric modeler. Versions prior to 1.1.2 fail to validate embedded file names when restoring .FCStd archives. A crafted document can write attacker-controlled content to arbitrary filesystem locations accessible to the FreeCAD user. Successful exploitation can enable persistence, credential compromise, configuration replacement, or code execution. The issue is fixed in FreeCAD 1.1.2.

Critical Impact
Opening a malicious .FCStd file allows an attacker to write files to arbitrary locations writable by the FreeCAD user, potentially leading to local code execution.

Affected Products

FreeCAD versions prior to 1.1.2
FreeCAD 3D parametric modeler across all supported platforms (Windows, macOS, Linux)
Fixed in FreeCAD 1.1.2

Discovery Timeline

2026-08-11 - CVE-2026-73234 published to NVD
2026-08-11 - Last updated in NVD database
Release 1.1.2 - FreeCAD publishes patched release addressing the flaw

Technical Details for CVE-2026-73234

Vulnerability Analysis

The vulnerability resides in PropertyFileIncluded::Restore() within src/App/PropertyFile.cpp. During document restoration, FreeCAD concatenates an attacker-controlled file or data attribute read from the Document.xml inside a .FCStd archive with the document's transient path. The restoration logic does not reject directory components, absolute paths, or parent-traversal sequences such as ...

An attacker crafts a .FCStd ZIP archive containing a FileIncluded XML attribute whose value points outside the intended extraction directory. When a user opens the document, FreeCAD writes the matching ZIP entry to the attacker-specified location using the privileges of the current user.

The write primitive extends across the user's filesystem scope. Attackers can drop autostart entries, replace shell configuration files, overwrite SSH keys, or plant shared libraries that later execute in the user's context.

Root Cause

The root cause is missing input validation on file-name attributes parsed from untrusted document XML. PropertyFileIncluded::Save() always writes basenames, so any name containing a directory separator, an absolute path, or ./.. originates from a malicious document and must be rejected.

Attack Vector

Exploitation requires local user interaction. The victim must open a malicious .FCStd file received via email, download, or shared storage. No elevated privileges are required at the time of exploitation; the write executes under the FreeCAD user's identity.

cpp

// Security patch adding basename validation in src/App/PropertyFile.cpp
namespace
{
/**
 * @brief Check that an embedded file name from a restored document is a plain basename.
 *
 * PropertyFileIncluded::Save() always stores basenames (via FileInfo::fileName()), so a
 * document that carries a name with any directory component, an absolute path, or a
 * .../.. reference is malicious.
 *
 * @param[in] name The file name taken from the document XML.
 * @return true if name is a safe basename, false if it must be rejected.
 */
bool isPlainFileName(const std::string& name)
{
    if (name == "." || name == "..") {
        return false;
    }
    return Base::FileInfo(name).fileName() == name;
}
}  // namespace

//**************************************************************************
// PropertyFileIncluded
//++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Source: FreeCAD Commit 7cabda0

Detection Methods for CVE-2026-73234

Indicators of Compromise

.FCStd archives containing FileIncluded XML attributes whose file or data values include /, \, .., or absolute path prefixes
File writes originating from the FreeCAD process to paths outside the expected document transient directory
Unexpected modifications to autostart directories, dotfiles, or SSH configuration following FreeCAD document open events

Detection Strategies

Inspect .FCStd files as ZIP archives and parse Document.xml to flag any FileIncluded name attributes that are not plain basenames
Monitor process-file lineage for FreeCAD writing to locations such as ~/.config/autostart/, ~/.bashrc, ~/.ssh/, or Windows Startup folders
Correlate document-open events with subsequent file creation events at sensitive paths

Monitoring Recommendations

Enable endpoint file-integrity monitoring on user-writable persistence locations
Log FreeCAD execution and child-process activity for post-open anomalies
Alert on FreeCAD writing executable content (.so, .dll, .desktop, scripts) outside its working directories

How to Mitigate CVE-2026-73234

Immediate Actions Required

Upgrade FreeCAD to version 1.1.2 or later on all endpoints
Do not open .FCStd files received from untrusted sources until the upgrade is applied
Audit shared design repositories for suspicious .FCStd archives predating remediation

Patch Information

The fix is included in FreeCAD Release v1.1.2. The patch introduces an isPlainFileName() helper that rejects any restored file name containing directory components, absolute paths, or ./.. references. See FreeCAD Pull Request #31269, FreeCAD Pull Request #31281, and GitHub Security Advisory GHSA-5vqh-3v38-jw2r for details.

Workarounds

Restrict FreeCAD execution to documents from trusted sources until patching is complete
Run FreeCAD under a dedicated low-privilege user account to limit the write scope of a successful exploit
Apply application-allowlisting policies that block writes from FreeCAD to persistence and configuration paths

bash

# Verify installed FreeCAD version and upgrade
freecad --version

# Debian/Ubuntu example
sudo apt update && sudo apt install --only-upgrade freecad

# Confirm patched version >= 1.1.2
freecad --version | grep -E "1\.(1\.[2-9]|[2-9])"