The flaw lies in the PropertyPythonObject::Restore function of FreeCAD, where an attacker‑controlled module name is passed directly to PyImport_ImportModule when restoring a crafted FCStd file. This unsandboxed import executes the module’s top‑level Python code on the system that runs FreeCAD, enabling arbitrary code execution—captured by CWE‑502 and CWE‑94. Such code can invoke system calls, leak sensitive data, or compromise the entire host operating system, effectively giving the attacker full code‑execution privileges on the user’s machine.

All versions of FreeCAD released before 1.1.2 are vulnerable. The fix was applied in the 1.1.2 release; newer releases after 1.1.2 are not affected.

The vulnerability has a CVSS base score of 7, indicating a medium to high severity. The EPSS score is less than 1%, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious FCStd file that a user opens with FreeCAD; therefore, the threat is largely user‑action dependent. Nonetheless, because the vulnerability permits arbitrary code execution once the file is processed, the potential damage is significant and the risk remains high if the software is not updated.