Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0146 72.6 —
AFFECTED Product Versions Fixed mayfly-go 1.11.0 – —
TIMELINE Sep 17 Reserved by VulDB Sep 17 Published (CNA: VulDB) Sep 22 EXPLOIT PUBLISHED — CVE-2026-92993 (Dromara mayfly-go). Public exploit reference added.
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. The vendor was contacted early about this disclosure but did not respond in any way.
| Date | Event | Detail |
|---|---|---|
| September 17, 2026 | Reserved | Reserved by VulDB |
| September 17, 2026 | Published | Published (CNA: VulDB) |
| September 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-92993 (Dromara mayfly-go). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Dromara | mayfly-go | — | 1.11.0 | — |
Authoritative record: CVE-2026-92993 at cve.org
Vendors: dromara
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-92993 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
