MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to… (CVE-2026-85439)

The vulnerability identified as CVE-2026-85439 affects MOOS-IvP versions up to 24.8.1. It exists in the alogsplit utility's SplitHandler::handlePreCheckSplitDir() function, which fails to sanitize shell metacharacters in log file pathnames. This improper input validation enables remote code execution by allowing attackers to inject shell commands via crafted log file names or the --dir parameter. The CVSS v3.1 score is 7.8, indicating a high severity with high impact on confidentiality, integrity, and availability. No patch or remediation information is provided, and no known exploits are reported in the wild. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows remote attackers to execute arbitrary commands with the privileges of the operator running alogsplit. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running alogsplit with untrusted input in log file names or the --dir parameter. Restrict access to the alogsplit utility and monitor for suspicious usage patterns related to log file handling.