---
id: CVE-2026-34977
title: Aperi'Solve is an open-source steganalysis web platform
summary: >-
  Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3
  through 3.2.0, when uploading a JPEG, a user can specify an optional password
  to accompany the JPEG. This password is then directly passed into an expect
  command,…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-04-06'
updated: '2026-06-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34977'
references:
  - url: >-
      https://github.com/Zeecka/AperiSolve/blob/9fc388c629f86221bf2a265559eba5650d39fc29/aperisolve/analyzers/jpseek.py
    label: security-advisories@github.com
  - url: >-
      https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4
    label: security-advisories@github.com
  - url: 'https://github.com/Zeecka/AperiSolve/pull/173'
    label: security-advisories@github.com
  - url: 'https://github.com/Zeecka/AperiSolve/pull/195'
    label: security-advisories@github.com
  - url: 'https://github.com/Zeecka/AperiSolve/releases/tag/3.1.3'
    label: security-advisories@github.com
  - url: 'https://github.com/Zeecka/AperiSolve/releases/tag/3.2.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp
    label: security-advisories@github.com
  - url: >-
      https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.01166
epssPercentile: 0.65921
ingestedAt: '2026-06-29T13:24:34.819Z'
---

## Overview

Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. This password is then directly passed into an expect command, which is then subsequently passed into a bash -c command, without any form of sanitization or validation. An unauthenticated attacker can achieve root-level RCE inside the worker container with a single HTTP request, enabling full read/write access to all user-uploaded images, analysis results, and plaintext steganography passwords stored on disk. Because the container shares a Docker network with PostgreSQL and Redis (no authentication on either), the attacker can pivot to dump the entire database or manipulate the job queue to poison results for other users. If Docker socket mounting or host volume mounts are present, this could escalate to full host compromise. This would also include defacement of the website itself. This vulnerability is fixed in 3.2.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.