CVE-2026-87723

Description

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.

Is your site exposed to CVE-2026-87723?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-426 CWE-426

References

Other References

https://github.com/google/fuse-archive/commit/4b13a49b4bf66e0960241bab78987dde268a8b81 https://github.com/google/fuse-archive/commit/6f086e6381428d5b818dcb1bf7b9204e6bf017f0

Frequently Asked Questions

What is CVE-2026-87723? +

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.

How do I check if I'm vulnerable to CVE-2026-87723? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-49642

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.

CVE-2024-3220

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file …

CVE-2026-84226

OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting …

CVE-2025-26624

Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 …

CVE-2026-0307

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges …

CVE-2025-9267

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to …