CVE-2017-16926: Ohcount Project Ohcount

Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days.

Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters, which can be exploited by an attacker (providing a source tree for Ohcount processing) to execute arbitrary code as the user running Ohcount.

Affected products

Published 2017-11-22. Last modified 2026-06-17.