PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Aug 2, 2026

Arelle < 2.39.10 - Remote Code Execution

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
3.3k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
9.2
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Arelleby Arelle
AFFECTED< 2.39.10SAFE ✓≥ 2.39.10
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Arelle < 2.39.10 - Remote Code Execution CVE-2026-42796 Scanner | S4E