{"id":"CVE-2016-15057","aliases":["EUVD-2016-10802","GHSA-77p9-w6pj-rmvg"],"status":"published","title":"Apache Continuum: Command injection leading to RCE","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-06","score":0.03888,"percentile":0.90288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2026-01-26T11:29:03Z","modified":"2026-06-17T00:41:05Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/apache_continuum_cmd_exec","title":"Apache Continuum Arbitrary Command Execution","type":"exploit","platform":"Linux","date":"2016-04-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_continuum_cmd_exec"}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.continuum:continuum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.continuum:continuum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"}]}],"versions":["1.2","1.2.2","1.2.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.4.0","1.4.1","1.4.2"]}],"products":[{"vendor":"apache","product":"continuum"},{"vendor":"apache software foundation","product":"apache continuum"}],"references":[{"url":"https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1","tags":["vendor-advisory","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/26/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-15057","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77p9-w6pj-rmvg"},{"url":"https://github.com/apache/continuum","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-15057","title":"Apache Continuum: Command injection leading to RCE","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-01-26T11:29:03.524Z","modified":"2026-01-26T18:06:06.158Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:33:32.415289Z"}],"euvd":[{"id":"EUVD-2016-10802","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-01-26T11:29:03Z","modified":"2026-01-26T18:06:06Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:47.293439Z"}],"ghsa":[{"id":"GHSA-77p9-w6pj-rmvg","title":"Apache Continuum vulnerable to Command Injection through Installations REST API","description":"***UNSUPPORTED WHEN ASSIGNED*** \n\nImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the Installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-01-26T12:30:29Z","modified":"2026-01-26T23:45:18Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2016-15057","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-01-26T12:15:46.353Z","modified":"2026-06-17T00:41:05.52Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:40.811555Z"}],"osv":[{"id":"GHSA-77p9-w6pj-rmvg","title":"Apache Continuum vulnerable to Command Injection through Installations REST API","description":"***UNSUPPORTED WHEN ASSIGNED*** \n\nImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the Installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2026-01-26T12:30:29Z","modified":"2026-02-03T03:07:35.489331Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}