The vulnerability arises from an unvalidated runtime configuration value in Apache CouchDB 3.5.2 and earlier on all platforms. This vulnerability is a CWE‑78 (OS Command Injection) flaw, allowing a server administrator to supply malicious configuration that is executed as a shell command under the CouchDB operating system user. This permits the attacker to run arbitrary code with the same privileges as the database process, leading to complete compromise of the host.

Apache Software Foundation’s CouchDB, versions 3.5.2 and below, regardless of operating system.

The CVSS base score of 9.3 indicates critical severity. Because the exploit requires administrative access to the CouchDB server and is only exploitable through the unsupported runtime configuration, the risk is limited to environments where an attacker can gain or already possesses admin credentials. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vector involves an attacker who has at least local admin privileges on the CouchDB machine or can send configuration updates through the admin API.