CVE-2026-50874: An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0

Synopsis

An OS command injection vulnerability affects the /manage/features/media component of kanishka-linux Reminiscence v0.3.0. The flaw is reachable over the network by any authenticated low-privilege user who can craft a malicious input to that endpoint, triggering execution of arbitrary operating system commands on the host. Successful exploitation gives an attacker full read access to sensitive data and the ability to modify files or system state. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Reminiscence service via HTTP to deliver the crafted input.

• AuthenticationRequired

  Any low-privilege account with access to the /manage/features/media endpoint is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker submits a crafted request directly to the server; no action from another user is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker can execute arbitrary OS commands on the host running Reminiscence, gaining the same system-level access as the application process.
• Confidential data accessible to that process, including stored credentials, session tokens, and application files, can be read directly.
• An attacker can modify or overwrite files, configuration, and persisted application data on the host.