{"id":"CVE-2026-104989","published":"2026-11-09T17:17:07.237","lastModified":"2026-11-09T18:17:19.433","description":"Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-427"],"vendors":[],"products":[],"references":[{"url":"https://documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21","tags":[]},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md","tags":[]}],"hasPoc":true,"ai":null}