FreeCAD vulnerabilities
We track 5 vulnerabilities in FreeCAD products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
Latest FreeCAD vulnerabilities
- 7.0 High severity
FreeCAD: Improper Control of Generation of Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyIm
- 7.8 High severity
FreeCAD: Improper Neutralization of Directives in Dynamically Evaluated Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrar
- 7.8 High severity
FreeCAD: Improper Neutralization of Directives in Dynamically Evaluated Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu,
- 7.8 High severity
FreeCAD: Improper Limitation of a Pathname to a Restricted Directory
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path wit
- 8.5 High severity
FreeCAD: Improper Control of Generation of Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementForm