CVE-2026-75031

Critical

Description

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe container which limits the scope of what it can do, unless the non-default AllowGlobal directive is configured for the catalog being accessed.CTOR]

SeverityCritical

CVSS9.8

Exploit probability—

ProductInterchange

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-94Code injection

How to fix

Patches

github.com/interchange/interchange/commit/65b6ea9d3761dd1fd2071c962819562afa335e4e

Vendor advisories

interchangecommerce.org/i/dev/news?mv_arg=00071

Affected products

Product	Affected versions	Fixed in
Interchange Interchange	0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.