CVE-2021-32305: WebSVN search parameter OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8 and very high EPSS probability, with public exploit code available.

What it is

WebSVN before 2.6.1 passes the search parameter to a shell without sanitising shell metacharacters, allowing OS command injection. Because the endpoint is reachable over the network with no authentication, any exposed instance is at risk of full remote code execution.

Impact

An unauthenticated attacker can execute arbitrary operating system commands with the privileges of the WebSVN web server process, leading to full compromise of the host and any data it can reach.

Attack surface

Reached remotely over the network via the search parameter; the CVSS vector shows no privileges required and no user interaction, so the vulnerable endpoint is directly exploitable by an unauthenticated client.

Exploitation

Not listed in CISA KEV, but EPSS is 0.873 (99.7th percentile) and public references include an Exploit-tagged Packet Storm advisory, indicating mature public exploit code and high likelihood of attempted exploitation.

What to do

• Upgrade WebSVN to 2.6.1 or later, which contains the fix in pull request 142.
• If immediate upgrade is not possible, restrict network access to the WebSVN instance to trusted users or place it behind an authenticated reverse proxy.
• Run the WebSVN web service under a low-privilege account with no shell access and minimal filesystem permissions.
• Review web server and application logs for suspicious characters or command strings in the search parameter and block them at the WAF if one is in use.

Detection

• Search web server access logs for requests to WebSVN search endpoints containing shell metacharacters such as ;, |, $(), backticks, or &&.
• Monitor for child processes spawned by the web server user (for example sh, bash, curl, wget, nc) that are not part of normal WebSVN operation.
• Alert on outbound network connections originating from the WebSVN host to unexpected destinations, which may indicate command execution callbacks.
• Audit file integrity in web-accessible directories and check for newly created scripts or binaries following suspicious search requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.