External risk intelligence

Chaos Software V-Ray Uncontrolled Search Path Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-104989

The vulnerability exists in a package upload feature, a common functionality in software that is frequently exposed to the internet to facilitate external contributions, remote updates, or file transfers. As an internet-accessible service feature, this component is commonly deployed in a manner that makes it reachable from public networks.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a package upload feature could allow unauthenticated attackers to execute code remotely by redirecting access to libraries. This issue affects Chaos Software V-Ray. The main concern is confirming relevance and exposure due to the potential for remote code execution.

Uncontrolled library access allows remote code execution.
Critical vulnerability impacts remote, unauthenticated users.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by redirecting access to libraries within the package upload feature. This could allow an unauthenticated remote attacker to execute arbitrary code.

No authentication required.
Attacker redirects library access.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code by redirecting access to libraries through the package upload feature. This could impact the integrity and availability of the affected system.

System integrity and availability at risk.
Remote unauthenticated access via library redirection.
Arbitrary code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The package upload feature in Chaos Software V-Ray is likely managed by an application or platform team, with oversight from network and security teams for external access. The immediate priority is to inventory all instances of V-Ray, determine their reachability and business criticality, and identify the accountable owner for remediation planning.

Confirm V-Ray instances and owner.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chaos Software V-Ray?

Chaos Software V-Ray is a rendering and visualization platform widely used by designers, architects, and artists to create photorealistic images and animations. Its package upload feature is a component often used for remote assets, updates, or collaboration. Understanding this context helps identify where the software resides in your environment, particularly regarding systems that handle file transfers or external data contributions.

What does CVE-2026-104989 mean for system security?

This vulnerability is classified as an uncontrolled search path element (CWE-427). Essentially, the software can be tricked into looking for program instructions or libraries in the wrong place. By redirecting this search path, an attacker can force the system to load and execute their own malicious code instead of legitimate files, leading to full unauthorized control over the affected system.

How does an attacker trigger this vulnerability?

The vulnerability is triggered through the package upload feature in V-Ray. An attacker does not need to be authenticated to initiate this process. The bug specifically relies on the ability to redirect the software's search for libraries during a file upload. Simply using the standard, authorized upload functions within an internal environment without external redirection attempts does not inherently trigger this flaw.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a higher-risk issue because the package upload feature is often deployed to be reachable from public networks to allow for remote updates or file sharing. If your V-Ray instance is internet-facing, it is more susceptible to unauthenticated access attempts. Systems restricted to internal, private networks face a reduced immediate profile for this specific remote attack vector.

What should I do if I run V-Ray?

Begin by creating an inventory of all V-Ray instances within your organization to understand which systems are running the affected versions. Coordinate with your network and application teams to verify the reachability of these systems from the internet. Once mapped, identify the technical owners for these assets and prioritize a review of their external access configurations while awaiting further vendor-specific guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.