CVE-2026-87723

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87723
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87723.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87723
Published
2026-09-28T04:02:14Z
Modified
2026-09-30T08:06:54Z
Severity
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Untrusted Search Path (PATH Hijacking) in fuse-archive
Details

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.

Database specific 
{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-426"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87723.json"
}
References

Affected packages

Git / github.com/google/fuse-archive

Affected ranges

Type
GIT
Repo
https://github.com/google/fuse-archive
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b13a49b4bf66e0960241bab78987dde268a8b81
Fixed
6f086e6381428d5b818dcb1bf7b9204e6bf017f0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.24"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v1.*
v1.0
v1.10
v1.12
v1.14
v1.16
v1.18
v1.2
v1.20
v1.22
v1.4
v1.6
v1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87723.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127728202841943266178644542665540003325",
                "164631494561856092024745273227113659183",
                "10935154864852931400450450613476418116",
                "284241780267018077749963564755468929616",
                "175761437600687493128924805885848392578",
                "5572025273668417832598097594063939697"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87723-2b329bf3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/google/fuse-archive/commit/4b13a49b4bf66e0960241bab78987dde268a8b81",
        "target":  {
            "file":  "fuse-archive.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "132555197363571607093758366701264595981",
            "length":  1854
        },
        "id":  "CVE-2026-87723-c90f6303",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/google/fuse-archive/commit/6f086e6381428d5b818dcb1bf7b9204e6bf017f0",
        "target":  {
            "file":  "fuse-archive.cc",
            "function":  "PrintUsage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "66107658111777430020167748142457429649",
                "184257656740179962948827185752634282681",
                "128963058244639595217514088082778644084",
                "39189778785247640013008611685210309218",
                "238235876287803795002250830193311857818",
                "286975474099538293437168716928481639428",
                "158543273777015670453926682920148571035",
                "101860122683689870431549765084378975073",
                "2181881447645426137188958411450442265",
                "221162431473400259600071629279712210529",
                "281827431936238709317627040074887321445",
                "11028198257593790433716685666413181876",
                "88892673343866795552162510334486974062",
                "47514827392806056628573665013128635261",
                "82389946446002216086843196680913676215",
                "288121796156875845582367219198511006948",
                "318959881601879999516688393733518249246",
                "140281921538310042929814185924475978887",
                "271371195326188742241306473956153352778",
                "29070046087880410232293487327382410033",
                "89984307049487768041770406626322973944",
                "14165985193321288498468129606146164478",
                "128075532060464402702671686569256992402",
                "313836142409694963160933334447348359780"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87723-dfc2bb6d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/google/fuse-archive/commit/6f086e6381428d5b818dcb1bf7b9204e6bf017f0",
        "target":  {
            "file":  "fuse-archive.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-30T08:06:54Z"