Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-17T21:16:44.130Z",
  "pubdate": "2026-08-17T21:16:44.130Z",
  "executiveSummary": "An arbitrary Python code execution vulnerability exists in FreeCAD within the BIM Project Manager Load Template flow. The vulnerability affects versions from 0.19 up to 1.1.1 and resides in src/Mod/BIM/bimcommands/BimProjectManager.py.\nThe flaw allows an attacker to achieve arbitrary code execution by supplying malicious FCStd Meta property values, specifically targeting the wpposition, wpu, wpv, and wpaxis parameters. When a victim user opens a maliciously crafted BIM project template, the application processes these properties and passes them directly to the built-in eval() function without proper sanitization or validation.\nThe impact of this vulnerability is critical, potentially leading to complete system compromise under the security context of the user running the application. An attacker requires the capability to distribute a malicious project template file and induce a victim to load it within the software. This vulnerability is resolved in version 1.1.1 through appropriate remediation measures implemented by the developers.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe handling and direct evaluation of untrusted input derived from project file metadata. Specifically, the vulnerable component is located in src/Mod/BIM/bimcommands/BimProjectManager.py within the BIM Project Manager Load Template workflow.\nDuring the template loading process, FreeCAD extracts metadata properties from the FCStd file format. The application reads attacker-controlled values assigned to the wpposition, wpu, wpv, and wpaxis Meta properties. Instead of parsing these geometric or positional properties safely using dedicated data parsers or type constructors, the application passes the raw strings directly into the Python eval() function.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious FreeCAD BIM project template file (FCStd) containing specially constructed Python payloads embedded within the target Meta property fields (wpposition, wpu, wpv, or wpaxis). 2) The attacker distributes this file to a target user via social engineering, phishing, or repository poisoning. 3) The victim opens the malicious project template using FreeCAD with the BIM workbench active. 4) The BIM Project Manager parses the project file and extracts the malicious Meta property strings. 5) The vulnerable script passes the malicious strings to eval(), which evaluates them as executable Python code. 6) Arbitrary code executes within the local operating system session, inheriting the permissions and access rights of the current FreeCAD user.\nThe vulnerability affects FreeCAD versions 0.19 through 1.1.1. Exploitation requires user interaction in the form of opening a malicious file, and does not require prior authentication or elevated privileges beyond the ability to supply a crafted file to the local application."
}