CVE-2026-39052

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String expression, String type, Map<String, Object> context) evaluates attacker-controlled script expressions through the underlying script engine without sandboxing or allowlist restrictions.

Published 2026-05-15. Last modified 2026-06-17.