CVE-2026-75031: Interchange RCE Vulnerability

CVE-2026-75031 Overview

A remote code execution vulnerability affects the Interchange e-commerce platform's quick_question admin feature. Unauthenticated attackers can inject arbitrary Perl code that executes server-side in default installations. The injected code runs inside a Safe container that limits its scope. When the non-default AllowGlobal directive is enabled for the accessed catalog, the Safe container restrictions no longer apply, allowing full code execution. The flaw is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary Perl code on Interchange servers over the network without user interaction, potentially resulting in full system compromise when AllowGlobal is enabled.

Affected Products

Interchange e-commerce platform (interchange/interchange project)
Installations exposing the admin quick_question feature
Catalogs configured with the AllowGlobal directive (higher impact scenario)

Discovery Timeline

2026-09-18 - CVE-2026-75031 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-75031

Vulnerability Analysis

Interchange is an open-source e-commerce and content management platform written in Perl. The vulnerability resides in the admin-facing quick_question feature, which processes CGI input through a [calc] template tag that evaluates Perl expressions.

Before the fix, the template rendered attacker-controlled CGI attributes directly into a [calc] block without an authentication gate. The Perl code executed inside the Safe compartment, which normally restricts dangerous operations. Installations that enabled the AllowGlobal directive on a catalog removed those Safe restrictions, promoting the injection to full arbitrary code execution in the Interchange server process.

Root Cause

The root cause is improper control of generated code [CWE-94] in dist/lib/UI/pages/admin/quick_question.html. The quick_question page passed CGI-supplied data into a Perl-evaluated [calc] block without requiring an authenticated administrative session. Any unauthenticated HTTP request reaching the endpoint could reach the evaluator.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the quick_question admin page with Perl payloads embedded in CGI parameters. The Interchange server parses the CGI attributes and evaluates them as Perl code. Under default configurations, the Safe container constrains what the payload can do, but information disclosure and denial-of-service outcomes remain viable. When AllowGlobal is configured, the payload achieves unrestricted RCE as the Interchange service account.

text

// Security patch excerpt from dist/lib/UI/pages/admin/quick_question.html
 separates out the attributes so they can be parsed later on.
 [/comment]
 
+[if-mm super]
 [calc]
   my $tempcgi = $CGI->{type};
   my @tempcgiarr = split(/\s{2,}/,$tempcgi);

Source: GitHub Commit 65b6ea9

The fix wraps the vulnerable [calc] block with an [if-mm super] guard, which requires an authenticated administrative session (super privilege) before the Perl evaluation runs.

Detection Methods for CVE-2026-75031

Indicators of Compromise

Unauthenticated HTTP requests targeting /admin/quick_question or the equivalent admin path
CGI parameter values containing Perl syntax such as system(, qx{, backticks, or open( patterns
Interchange error logs referencing [calc] evaluation failures or Safe compartment violations
Unexpected child processes spawned by the Interchange daemon (interchange, interchange.server)

Detection Strategies

Inspect Interchange access logs for requests to the quick_question page originating from unauthenticated sessions
Alert on CGI parameter payloads containing Perl operators or function names commonly used in RCE
Correlate web-tier request logs with process creation telemetry on the Interchange host to identify shell descendants
Deploy Web Application Firewall (WAF) rules that block Perl code fragments in query strings and POST bodies destined for admin endpoints

Monitoring Recommendations

Monitor outbound network connections from the Interchange service account for anomalous destinations
Track file integrity on the Interchange installation directory, especially dist/lib/UI/pages/admin/ templates
Baseline typical CGI parameter lengths and character distributions to flag injection attempts
Forward Interchange application logs to a centralized SIEM for retrospective hunting

How to Mitigate CVE-2026-75031

Immediate Actions Required

Apply the upstream Interchange patch from commit 65b6ea9d3761dd1fd2071c962819562afa335e4e immediately
Audit catalog configurations for the AllowGlobal directive and disable it unless strictly required
Restrict network access to the Interchange admin interface using firewall rules or reverse-proxy allowlists
Review Interchange logs for prior exploitation attempts against quick_question

Patch Information

The Interchange project addressed the vulnerability by adding an [if-mm super] administrative privilege check around the vulnerable [calc] template in dist/lib/UI/pages/admin/quick_question.html. Details are available in the GitHub commit and the Interchange Commerce news announcement. Administrators should upgrade to the patched Interchange release and verify the template file contains the [if-mm super] guard.

Workarounds

Place the Interchange admin interface behind an authenticated reverse proxy or VPN
Remove or rename the quick_question.html template if the feature is unused
Ensure AllowGlobal is not set for any production catalog to keep Perl execution constrained by the Safe container
Deploy WAF signatures that drop requests containing Perl code fragments to /admin/quick_question

bash

# Verify the patched template contains the administrative privilege guard
grep -n "if-mm super" dist/lib/UI/pages/admin/quick_question.html

# Audit catalog configuration files for the AllowGlobal directive
grep -rn "AllowGlobal" /path/to/interchange/catalogs/