Vulnerability · Published Feb 22, 2026 · Assigned by VulDB

CVE-2026-2952Vaelsys HTTP POST Request tree_server.php os command injection

High 7.3

In plain English

A high-severity OS command injection in Vaelsys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.4% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)8.4%top 5.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request Handler. This manipulation of the argument xajaxargs causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	Vaelsys	4.1.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-347318 | Vaelsys HTTP POST Request tree_server.php os command injection vdb-entry, technical-description
VDB-347318 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #755166 | Vaelsys Vaelsys V4 4.1.0 Command Injection / Remote Code Execution third-party-advisory
https://github.com/CVE-Hunter-Leo/CVE/issues/10 exploit, issue-tracking