DreamFactory Command Injection Vulnerability in saveZipFile Method Allows Remote Code Execution
Vulnerability
A command injection vulnerability allowing remote code execution has been identified in DreamFactory. This issue arises from improper validation of user-supplied strings in the saveZipFile method, enabling authenticated attackers to execute arbitrary code on the server with the privileges of the service account.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the affected server, with the executed code running in the context of the service account.
Remediation
DreamFactory has released a patch for this vulnerability. Users can update to the latest version to address this issue.
Added: Dec 23, 2025, 10:50 PM
Updated: Dec 23, 2025, 10:50 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
5.9remediation
0.0relevance
1.7threat
3.2urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.