CVE

CVE-2026-42796

9.2

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

arelle

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process. References: https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure https://github.com/Arelle/Arelle/pull/2320 https://github.com/Arelle/Arelle/releases/tag/2.39.10 https://nvd.nist.gov/vuln/detail/CVE-2026-42796 Remediation: Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.

Used 3.3k times · url

Scanner page →Run scanner

CVE history: arelle

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →