freecad: security issues < 1.1.2

[Nixpkgs security tracker issue](https://tracker.security.nixos.org//issues/NIXPKGS-2026-2406) ## [CVE-2026-73235](https://nvd.nist.gov/vuln/detail/CVE-2026-73235) <details> <summary><strong>6.1 MEDIUM</strong> | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N</summary> - CVSS version (CVSS): 3.1 - Attack Vector (AV): Local (L) - Attack Complexity (AC): Low (L) - Privileges Required (PR): None (N) - User Interaction (UI): Required (R) - Scope (S): Unchanged (U) - Confidentiality (C): High (H) - Integrity (I): Low (L) - Availability (A): None (N) - Modified Attack Vector (MAV): Local (L) - Modified Attack Complexity (MAC): Low (L) - Modified Privileges Required (MPR): None (N) - Modified User Interaction (MUI): Required (R) - Modified Confidentiality (MC): High (H) - Modified Scope (MS): Unchanged (U) - Modified Integrity (MI): Low (L) - Modified Availability (MA): None (N) </details> <details><summary><strong>FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser</strong></summary> FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2. </details> ### References - [https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49](https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49) (`x_refsource_CONFIRM`) - [https://github.com/FreeCAD/FreeCAD/pull/31271](https://github.com/FreeCAD/FreeCAD/pull/31271) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/pull/31280](https://github.com/FreeCAD/FreeCAD/pull/31280) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73](https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3](https://github.com/FreeCAD/FreeCAD/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2](https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2) (`x_refsource_MISC`) ### Affected packages - `freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-qt6` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-qt6+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-wayland` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-wayland+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `pkgsRocm.freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+pkgsRocm.freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable Affected package maintainers: cc @LordGrimmauld, @srounce ## [CVE-2026-73234](https://nvd.nist.gov/vuln/detail/CVE-2026-73234) <details> <summary><strong>7.8 HIGH</strong> | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</summary> - CVSS version (CVSS): 3.1 - Attack Vector (AV): Local (L) - Attack Complexity (AC): Low (L) - Privileges Required (PR): None (N) - User Interaction (UI): Required (R) - Scope (S): Unchanged (U) - Confidentiality (C): High (H) - Integrity (I): High (H) - Availability (A): High (H) - Modified Attack Vector (MAV): Local (L) - Modified Attack Complexity (MAC): Low (L) - Modified Privileges Required (MPR): None (N) - Modified User Interaction (MUI): Required (R) - Modified Confidentiality (MC): High (H) - Modified Scope (MS): Unchanged (U) - Modified Integrity (MI): High (H) - Modified Availability (MA): High (H) </details> <details><summary><strong>FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()</strong></summary> FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2. </details> ### References - [https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-5vqh-3v38-jw2r](https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-5vqh-3v38-jw2r) (`x_refsource_CONFIRM`) - [https://github.com/FreeCAD/FreeCAD/pull/31269](https://github.com/FreeCAD/FreeCAD/pull/31269) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/pull/31281](https://github.com/FreeCAD/FreeCAD/pull/31281) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/7cabda0979779251bad516cb6911a43dc03c5203](https://github.com/FreeCAD/FreeCAD/commit/7cabda0979779251bad516cb6911a43dc03c5203) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d](https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2](https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2) (`x_refsource_MISC`) ### Affected packages - `freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-qt6` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-qt6+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-wayland` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-wayland+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `pkgsRocm.freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+pkgsRocm.freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable Affected package maintainers: cc @LordGrimmauld, @srounce ## [CVE-2026-73233](https://nvd.nist.gov/vuln/detail/CVE-2026-73233) <details> <summary><strong>8.5 HIGH</strong> | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</summary> - CVSS version (CVSS): 4.0 - Attack Vector (AV): Local (L) - Attack Complexity (AC): Low (L) - Attack Requirement (AT): None (N) - Privileges Required (PR): None (N) - User Interaction (UI): Passive (P) - Vulnerable System Impact Confidentiality (VC): High (H) - Vulnerable System Impact Integrity (VI): High (H) - Vulnerable System Impact Availability (VA): High (H) - Subsequent System Impact Confidentiality (SC): None (N) - Subsequent System Impact Integrity (SI): None (N) - Subsequent System Impact Availability (SA): None (N) - Modified Attack Vector (MAV): Local (L) - Modified Attack Complexity (MAC): Low (L) - Modified Attack Requirement (MAT): None (N) - Modified Privileges Required (MPR): None (N) - Modified User Interaction (MUI): Passive (P) - Modified Vulnerable System Impact Confidentiality (MVC): High (H) - Modified Vulnerable System Impact Integrity (MVI): High (H) - Modified Vulnerable System Impact Availability (MVA): High (H) - Modified Subsequent System Impact Confidentiality (MSC): Negligible (N) - Modified Subsequent System Impact Integrity (MSI): Negligible (N) - Modified Subsequent System Impact Availability (MSA): Negligible (N) - Safety (S): Not Defined (X) - Automatable (AU): Not Defined (X) - Recovery (R): Not Defined (X) - Value Density (V): Not Defined (X) - Vulnerability Response Effort (RE): Not Defined (X) - Provider Urgency (U): Not Defined (X) - Confidentiality Req. (CR): Not Defined (X) - Integrity Req. (IR): Not Defined (X) - Availability Req. (AR): Not Defined (X) - Exploit Maturity (E): Not Defined (X) </details> <details><summary><strong>FreeCAD: FEM formula incomplete escape</strong></summary> FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2. </details> ### References - [https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q](https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q) (`x_refsource_CONFIRM`, `exploit`) - [https://github.com/FreeCAD/FreeCAD/pull/31267](https://github.com/FreeCAD/FreeCAD/pull/31267) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/pull/31312](https://github.com/FreeCAD/FreeCAD/pull/31312) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2](https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e](https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e) (`x_refsource_MISC`) - [https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2](https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2) (`x_refsource_MISC`) ### Affected packages - `freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-qt6` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-qt6+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `freecad-wayland` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+freecad-wayland+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable - `pkgsRocm.freecad` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+pkgsRocm.freecad+in%3Atitle+-%3E+in%3Atitle)) - 1.1.1@nixos-26.05 - 1.1.1@nixos-unstable Affected package maintainers: cc @LordGrimmauld, @srounce # Next steps - Start here if this is your first security issue: [Triaging and fixing security issues](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#triaging-and-fixing) - Backports are usually needed: [Backporting security fixes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests)