CVE-2026-11408

vertex-app vertex Log Viewer Endpoint LogMod.js os command injection

State: Published
Severity: 5.3 Medium
Published: Jun 6, 2026
Updated: Jun 8, 2026
Reserved: Jun 5, 2026

Description

A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
vertexvertex-app	2026.02.0Affected 2026.02.1Affected 2026.02.2Affected 2026.02.3Affected 2026.02.4Affected 2026.02.5Affected 2026.02.6Affected 2026.02.7Affected 2026.02.8Affected 2026.02.9Affected 2026.02.10Affected 2026.02.11Affected 2026.02.12Affected

References

VDB-368967 | vertex-app vertex Log Viewer Endpoint LogMod.js os command injectionvdb-entrytechnical-description
VDB-368967 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-11408 | CVE Analysis and Reportthird-party-advisory
Submit #818442 | vertex-app vertex up to v2026.02.12 OS Command Injectionthird-party-advisory
https://gist.github.com/menelausx/e632faba4014474fcef6a1f541ca3e4erelated
https://drive.google.com/drive/folders/1DO-kB1eUoB1CksJ_ZKzpUaX0kp5Rgm_T?usp=sharingexploit
https://github.com/vertex-app/vertex/commit/805d82e7100d49b79b3beb1b9420e8e458987198patch
https://github.com/vertex-app/vertex/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.