CVE-2026-52473: n/a

This vulnerability in Wgcloud 3.6.4 involves the unsafe concatenation of user-controlled input (the content parameter) into a ProcessBuilder command, allowing a remote attacker to escalate privileges. The CVSS score is 4.3, indicating a medium severity with low attack complexity and no user interaction required. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). There is no vendor advisory or patch information available at this time.

An attacker who can supply input to the vulnerable content parameter may execute arbitrary commands with escalated privileges on the affected system. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported. The attack vector is adjacent network (AV:A), meaning the attacker must have access to the local network or similar environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable interface to trusted users only and monitor for suspicious activity related to command execution attempts involving the content parameter.