Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T20:18:48.833Z",
  "pubdate": "2026-08-11T20:18:48.833Z",
  "executiveSummary": "An arbitrary file write vulnerability exists in FreeCAD prior to version 1.1.2, specifically within the PropertyFileIncluded::Restore() function located in src/App/PropertyFile.cpp. The flaw arises from insecure string concatenation of attacker-controlled file or data attributes originating from Document.xml with the document transient path, lacking proper validation against directory components, absolute paths, or parent traversal sequences.\nSuccessful exploitation allows a malicious actor to construct a crafted .FCStd archive containing a manipulated FileIncluded XML attribute and a corresponding ZIP entry. When a victim opens this specially crafted archive, the application writes attacker-controlled content to arbitrary locations accessible to the running FreeCAD user context.\nThe risk implications are severe, potentially enabling persistence mechanisms, credential compromise, configuration file replacement, or arbitrary code execution depending on the target file paths and user privileges. The attack vector requires user interaction, specifically opening an untrusted .FCStd file.",
  "technicalDetails": "The vulnerability resides in the PropertyFileIncluded::Restore() method implemented in src/App/PropertyFile.cpp within FreeCAD prior to version 1.1.2. The root cause is insufficient input sanitization and validation of the file or data attribute extracted from Document.xml inside a .FCStd archive.\nDuring the restoration process of a FreeCAD document, the application retrieves path or filename attributes associated with property files from the XML structure. These attributes are directly concatenated with the document transient path. The codebase fails to reject or sanitize directory traversal sequences such as dot-dot-slash (../), absolute file paths, or embedded directory components.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious .FCStd archive, which is fundamentally a ZIP archive containing an XML document named Document.xml and arbitrary payload files. 2) The attacker modifies the FileIncluded XML attribute within Document.xml to include directory traversal sequences or absolute paths targeting sensitive system or user-writable locations. 3) The attacker embeds the malicious payload inside the archive matching the targeted reference. 4) The victim is induced to open the crafted .FCStd file using a vulnerable version of FreeCAD. 5) FreeCAD parses Document.xml and executes PropertyFileIncluded::Restore(), which concatenates the traversal path with the transient path without validation. 6) The application extracts and writes the payload from the archive directly to the attacker-specified arbitrary location on the filesystem.\nThe vulnerable component is the PropertyFileIncluded::Restore() function in src/App/PropertyFile.cpp. Affected versions include all FreeCAD releases prior to 1.1.2. Exploitation does not require authentication or network exposure, as it is triggered locally via file parsing, but it relies on user interaction to open the malicious archive. The execution context and privileges are bound to the user running the FreeCAD application, and post-exploitation impact includes unauthorized file creation, overwriting critical configuration data, establishing persistence, or achieving code execution."
}