Aperi'Solve, an open‑source steganalysis web platform, contains a command‑injection flaw that allows an unauthenticated attacker to execute arbitrary system commands with root privileges inside the worker container. The vulnerability arises when a password supplied during a JPEG upload is unsanitized and passed to an expect command that in turn executes a bash -c. By exploiting this, the attacker can read, modify, or delete any file in the container, including user images, analysis results, and stored plaintext steganography passwords. The absence of authentication on the container network also permits the attacker to access connected PostgreSQL and Redis instances, potentially dumping the entire database or tampering with other users’ job queues. If the host has Docker socket or volume mounts exposed, the flaw could further elevate to full host compromise and website defacement.

The vulnerability affects versions of Zeecka’s AperiSolve platform older than 3.2.1. Attackers need only the open web interface; no special credentials are required. The flaw is present in all installations that use the default Docker networking without authentication to PostgreSQL or Redis.

The flaw scores a CVSS of 9.3, indicating critical severity. EPSS data is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, but its exploitation requires only a single unauthenticated HTTP request. Because the affected code executes commands in the container’s root path, an attacker can achieve full read/write access and, depending on host exposure, potentially pivot to the underlying host system. The risk remains high until the fixed 3.2.1 release is applied.