Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-17T21:16:44.277Z",
  "pubdate": "2026-08-17T21:16:44.277Z",
  "executiveSummary": "A remote code execution vulnerability exists within the BIM Workbench of FreeCAD, specifically involving insecure deserialization and execution of untrusted data.\nThe flaw resides in the handling of SVG template files processed during the creation of TechDraw pages.\nBy supplying a maliciously crafted SVG template containing embedded Python code, an attacker can achieve arbitrary code execution within the context of the user running the application.\nThis vulnerability impacts FreeCAD versions from 0.19 up to 1.1.1.\nThe risk implication is severe, as successful exploitation allows an attacker to execute arbitrary system commands, manipulate local files, or compromise the underlying host operating system.\nExploitation requires user interaction, specifically the victim initiating the creation of a TechDraw page using the malicious SVG template file.\nNo specific authentication or network exposure is inherently required beyond the ability to deliver or trick the user into utilizing the malicious template file.",
  "technicalDetails": "The vulnerability stems from the direct invocation of the Python eval() function on untrusted data derived from SVG template files within the BIM Workbench.\nThe vulnerable component is located in the source file src/Mod/BIM/bimcommands/BimTDPage.py at line 87.\nAffected versions include FreeCAD from 0.19 through 1.1.1.\nThe attack flow begins when an attacker crafts a malicious SVG template file designed to inject arbitrary Python expressions into fields processed by the TechDraw page generation routine.\nWhen a user attempts to create a TechDraw page using this crafted SVG template, FreeCAD reads the contents of the file during processing.\nThe application passes the untrusted string data directly into the eval() function without prior sanitization, validation, or structural parsing containment.\nBecause eval() executes the string as native Python code within the current interpreter session, the embedded payload executes immediately with the full privileges of the user running FreeCAD.\nThis behavior bypasses standard application boundaries, allowing post-exploitation impacts such as arbitrary command execution, data exfiltration, or modification of local filesystem resources.\nThe vulnerability requires local access to a malicious file and explicit user interaction to trigger the parsing engine, but operates independently of network exposure or authentication mechanisms."
}