CVE-2026-34977 is an OS command injection vulnerability (CWE-78) in Zeecka AperiSolve, an open-source steganalysis platform. In versions 3.1.3 through 3.2.0, the optional password parameter supplied during JPEG upload is passed directly into an expect command, which is then executed via bash -c without sanitization or validation. This allows unauthenticated attackers to achieve root-level remote code execution within the worker container. The container's shared Docker network with unauthenticated PostgreSQL and Redis services permits attackers to dump databases or poison job queues. Presence of Docker socket or host volume mounts could enable full host compromise and website defacement. The vulnerability is resolved in version 3.2.1.

An unauthenticated attacker can gain root-level remote code execution inside the Aperi'Solve worker container, leading to full read/write access to user-uploaded images, analysis results, and plaintext passwords stored on disk. The attacker can pivot to unauthenticated PostgreSQL and Redis services on the same Docker network to dump databases or manipulate job queues, affecting other users. If Docker socket or host volume mounts are configured, the attacker may escalate privileges to compromise the host system entirely, including defacing the website.

Upgrade Aperi'Solve to version 3.2.1 or later, where this OS command injection vulnerability is fixed. There is no indication of temporary or alternative mitigations; applying the official fix is required to remediate the issue.