CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2024-20328

ClamAV VirusEvent: When the Antivirus Becomes the Virus

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·5 min read·165 visits

Executive Summary (TL;DR)

ClamAV's configuration allows admins to run a command when a virus is found. By failing to sanitize the filename placeholder (%f) before passing it to 'sh -c', the engine executes any shell commands embedded in the name of the infected file. It's a 1990s-style vulnerability in a 2024 security product.

A classic OS Command Injection vulnerability in ClamAV's 'VirusEvent' feature allows local attackers to execute arbitrary code by simply naming a file with malicious shell characters.

Official Patches

CiscoOfficial Cisco Security Advisory
ClamAV BlogRelease notes for fixed versions

Fix Analysis (1)

Technical Appendix

CVSS Score
5.3/ 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Cisco ClamAV 1.2.0 - 1.2.1Cisco ClamAV 1.1.x (all versions)Cisco ClamAV 1.0.0 - 1.0.4Cisco ClamAV 0.104.xCisco ClamAV 0.105.x

Affected Versions Detail

Product
Affected Versions
Fixed Version
ClamAV
Cisco
1.2.0 - 1.2.11.2.2
ClamAV
Cisco
1.0.0 - 1.0.41.0.5
ClamAV
Cisco
<= 0.105.x1.0.5
AttributeDetail
CWECWE-78 (OS Command Injection)
Attack VectorLocal (potentially Remote via file upload)
CVSS v3.15.3 (Medium)
ImpactArbitrary Code Execution / Privilege Escalation
Vulnerable Componentclamd daemon (VirusEvent)
Exploit StatusProof of Concept Available

MITRE ATT&CK Mapping

T1203Exploitation for Client Execution
Execution
T1059.004Command and Scripting Interpreter: Unix Shell
Execution
T1574Hijack Execution Flow
Persistence
CWE-78
OS Command Injection

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Known Exploits & Detection

MetasploitModules targeting similar local command injections typically appear quickly.
GitHub PoCTechnical writeup and reproduction steps by Amit Schendel.
NucleiDetection Template Available

Vulnerability Timeline

Advisory Published by Cisco
2024-01-15
Fixed Versions Released (1.3.0, 1.2.2, 1.0.5)
2024-01-15
PoC Details Publicly Circulated
2024-02-01

References & Sources

  • [1]ClamAV Release Notes
  • [2]Deep Dive by Amit Schendel
Related Vulnerabilities
CVE-2023-20032CVE-2023-20052

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 9 hours ago•CVE-2026-82329
9.8

CVE-2026-82329: Critical Authentication Bypass and Privilege Escalation in JFrog Artifactory

CVE-2026-82329 is a critical authentication bypass vulnerability in the core authentication mechanisms of JFrog Artifactory. Classified under CWE-287, this security weakness allows remote, unauthenticated attackers to bypass authentication controls and obtain full administrative privileges on vulnerable self-managed deployments running default configurations.

Amit Schendel
Amit Schendel
51 views•8 min read
•1 day ago•CVE-2026-55854
5.9

CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch

CVE-2026-55854 identifies a critical security flaw in the MariaDB Connector for Node.js (mariadb npm package). When establishing connections, the driver fails to validate transport security requirements during Pluggable Authentication Modules (PAM) dialog authentication. This vulnerability allows active on-path attackers or malicious database servers to coerce the client driver into transmitting user credentials in cleartext over unencrypted TCP connections.

Amit Schendel
Amit Schendel
6 views•6 min read
•1 day ago•CVE-2026-55764
8.7

CVE-2026-55764: Integer Overflow in SFT Circulation Counter in Klever-Go

An integer overflow vulnerability (CWE-190) exists in klever-go, the Go implementation of the Klever blockchain protocol, within the Semi-Fungible Token (SFT) addition path. An attacker with a mint role can exploit this by passing an extremely large positive value when adding SFT quantity, which overflows a signed 64-bit integer. This bypasses the maximum supply checks and allows minting arbitrary tokens while corrupting the state.

Alon Barad
Alon Barad
4 views•8 min read
•1 day ago•CVE-2026-55841
7.5

CVE-2026-55841: Log Evasion and Tampering in Graylog FortiGate Syslog Parser

A high-severity log evasion and tampering vulnerability in Graylog's FortiGate key-value syslog parser allows unauthenticated remote attackers to modify, delete, or overwrite critical security log fields, potentially bypassing security controls and monitoring systems.

Alon Barad
Alon Barad
6 views•7 min read
•1 day ago•CVE-2026-55867
5.3

CVE-2026-55867: Insecure Direct Object Reference in Graylog Access-Token Revocation

An Insecure Direct Object Reference (IDOR) vulnerability exists within the access-token revocation endpoint of Graylog. Authenticated users can exploit this flaw to delete access tokens belonging to other users, including high-privileged administrator accounts, thereby disrupting active integrations and API access.

Alon Barad
Alon Barad
6 views•7 min read
•1 day ago•CVE-2026-55873
4.3

CVE-2026-55873: Improper Authorization in SeaweedFS S3Tables and Iceberg REST Management APIs

An improper authorization vulnerability in SeaweedFS versions 4.08 through 4.33 allows authenticated, low-privileged users to bypass directory isolation and perform unauthorized metadata operations within S3Tables and Iceberg REST interfaces. The vulnerability arises from an automatic collapse of account-less static identities to the default administrative principal, combined with a fail-open default policy configuration and self-referential authorization parameters in the table bucket listing routines. Together, these logical flaws expose administrative configurations and namespace architectures to unprivileged actors. The issue is resolved in version 4.34 by enforcing capability-based access checks, isolating fallback modes, and performing granular access verification on target buckets.

Alon Barad
Alon Barad
3 views•6 min read