CVE-2026-34398

The CVSS 7.8 score on CVE-2026-34398 obscures a more serious reality. While the metric marks attack complexity as High because a victim must load a malicious file, this completely mischaracterizes the actual risk in BIM workflows. Architectural and engineering teams routinely exchange template files as part of standard practice—loading a template from a vendor, client, or online repository is not a suspicious action, it is the workflow. An attacker who distributes a crafted FCStd file embedded in a plausible template package has realistic chances of execution, and the eval() calls on the wpposition, wpu, wpv, and wpaxis Meta properties make arbitrary code execution straightforward once the file is loaded. The deeper concern is that these four eval() calls almost certainly represent a design assumption, not an isolated oversight. The BimProjectManager module was built to persist and restore working plane geometry quickly—eval() was the expedient solution that worked for every legitimate template, and nobody was paid to ask what happens when a hostile file arrives. The patch in version 1.1.1 removes those four calls, but the critical question is whether FreeCAD's threat model now treats all parsed files as untrusted input, or whether it simply patched the incident without examining the pattern. For defenders in BIM environments, this matters more than the CVE score suggests. A compromised template doesn't stay contained on one workstation. FreeCAD exports to IFC, which flows into structural analysis tools, quantity takeoff systems, fabrication platforms, and project coordination software. A malicious template can poison the authoritative data model for an entire building project, creating downstream contamination that spreads across the project ecosystem. Audit your FreeCAD deployment now. Confirm whether 1.1.1 implements input validation or sandboxing on Meta property parsing more broadly, or only addressed these four specific fields. Treat any FreeCAD installation that loads external templates as a potential code execution vector until proven otherwise. Isolate BIM workstations from shared network paths where templates circulate, and verify the integrity of any template before loading it—every .fcstd file you open is executing code, regardless of whether it came from a trusted colleague or a vendor portal.

Reviewed through automated stages and approved by a human before publication.