The flaw resides in PropertyFileIncluded::Restore(), which concatenates a user-controlled file name from Document.xml with the path to the transient document location without rejecting directory components, absolute paths, or parent traversal. This permits an attacker to craft a .FCStd archive that injects any file name, allowing the prepared FCStd file to write arbitrary content to locations reachable by the FreeCAD user. The consequence includes unauthorized persistence, credential theft, configuration replacement, and potentially execution of malicious code if a file with executable payload reaches a system executable path or a place where FreeCAD will load it.

The vulnerability affects FreeCAD versions prior to 1.1.2, deployed by the FreeCAD project. Any installation of the software that has not upgraded beyond 1.1.2 is susceptible.

With a CVSS score of 7.8 this issue is classified as high severity. The EPSS score is less than 1 %, suggesting that exploitation is not widespread yet, and the vulnerability is not listed in CISA’s KEV catalog. The exploitation requires a malicious .FCStd file that an attacker crafts; a local user must open or import the file. Attacking conditions are minimal – no complex network access or elevated privileges are needed beyond the victim’s user account. The attack vector is predominantly local, though if the compromised file is placed in a shared or networked location, it may affect other users who subsequently open the file.