CVE-2011-10026 Spreecommerce < 0.50.x API RCE

What is CVE-2011-10026?

CVE-2011-10026 is a critical command injection vulnerability in Spreecommerce, published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.

Weakness: CWE-78

Which versions are affected by CVE-2011-10026?

4 open source packages ship an affected version, including rd_searchlogic and spree. It affects 1 product.

Products include Spreecommerce Spree.

How do I fix CVE-2011-10026?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2011-10026 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-10026 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Spreecommerce

• CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE Critical 10.0
• CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID High 7.7
• CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses High 7.7
• CVE-2020-26223 Authorization bypass in Spree High 7.7
• CVE-2026-22589 Spree API has Unauthenticated IDOR - Guest Address High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x485-rhg3-cqr4.