CVE-2011-10019
Spreecommerce < 0.60.2 Search Parameter RCE
CVE-2011-10019 is a critical vulnerability (CVSS 10.0) in Spreecommerce Spree, published August 13, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.25%, the 93rd percentile. Fixed in spree 0.60.2.
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spreecommerce < 0.60.2 Search Parameter RCE
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
- Record
CVE-2011-10019- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-94, CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2011-5240
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
- Record
EUVD-2011-5240- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-97vm-c39p-jr86
Spree has Remote Command Execution vulnerability in search functionality
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
- Record
GHSA-97vm-c39p-jr86- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-1321
- Updated
- 2026-11-02
NVD
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
- Record
CVE-2011-10019- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-1321
- Updated
- 2026-11-02
OSVGHSA-97vm-c39p-jr86
Spree has Remote Command Execution vulnerability in search functionality
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
- Record
GHSA-97vm-c39p-jr86- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spreeRubyGems |
before 0.60.2 | 0.60.2 |
spreeRubyGems |
before 0.60.2, plus listed versions 0.0.50.0.60.0.70.0.80.0.9 Show 45 moreShow less0.10.00.10.0.beta0.10.10.10.20.11.00.11.10.11.20.11.30.11.40.2.00.30.00.30.0.beta10.30.10.30.20.4.00.4.10.40.00.40.10.40.20.40.30.40.40.5.00.5.10.50.00.50.10.50.20.50.30.50.40.6.00.60.00.60.0.RC10.60.10.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.9.00.9.10.9.20.9.30.9.4 |
0.60.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Spreecommerce 0.60.1 Arbitrary Command Execution | 2011-10-05 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV |
References
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb
exploit-db.com/exploits/17941
web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group
vulncheck.com/advisories/spreecommerce-search-parameter-rce
github.com/orgs/spree
nvd.nist.gov/vuln/detail/CVE-2011-10019