What is GHSA-fq98-vw8w-5vf9?

GHSA-fq98-vw8w-5vf9 is a security advisory published by GitHub Security Advisories with High severity. Improper neutralization of shell metacharacters in the timezone configuration field in certain...

Which CVE IDs does GHSA-fq98-vw8w-5vf9 cover?

GHSA-fq98-vw8w-5vf9 covers the following CVE IDs: CVE-2026-111560. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-fq98-vw8w-5vf9High

Improper neutralization of shell metacharacters in the timezone configuration field in certain...

Vendor

GitHub Security Advisories

Published

November 2, 2026

Last Modified

November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-111560 →

📋 Description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-111560
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
https://github.com/advisories/GHSA-fq98-vw8w-5vf9