A critical remote code execution vulnerability (CVE-2026-45579) exists in DIRAC's RequestManager due to unsafe use of eval() on untrusted input parameters in the export_getRequestCountersWeb function. This function is accessible to any authenticated user and passes parameters directly to the database layer, where unrecognized groupingAttribute strings are prepended with 'Request.' and evaluated. By crafting malicious input strings, attackers can escalate to OS-level commands, compromising the server. Multiple eval usages in the RequestManager and RequestDB components may be vulnerable. The vulnerability allows attackers to read sensitive configuration files, extract database passwords, and export stored proxies and tokens. Exploitation leaves exception traces in logs but can be erased if local logging is used. Official patches are released in DIRAC versions 8.0.79, 9.0.22, and 9.1.10.

Exploitation enables any authenticated user to execute arbitrary code on the DIRAC server with the privileges of the DIRAC service user. This leads to full system compromise, including unauthorized access to configuration files (e.g., dirac.cfg), database credentials, and security tokens. The attacker can also remove evidence of exploitation from local logs, complicating forensic analysis.

Fixed versions of DIRAC are available starting from 8.0.79, 9.0.22, and 9.1.10. Users should upgrade to these or later versions to remediate the vulnerability. No alternative mitigations or workarounds are indicated. Patch status is confirmed by the vendor through published version releases.