CVE-2026-107780

Executive Summary

CVE-2026-107780 is a critical OS command injection vulnerability (CWE-78) affecting Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321, exploitable via the unauthenticated /post/TtsController/textToSpeech endpoint through the format parameter. An attacker can inject a single quote to break out of an underlying PowerShell string and execute arbitrary commands as the Skyeye service account, yielding full compromise of confidentiality, integrity, and availability (CVSS 9.8). No public proof-of-concept, exploit code, or Nuclei template is currently available, and no vendor patch has been identified from any tracked source.

Technical Analysis

The vulnerability resides in the text-to-speech (TTS) handling path of Dromara Skyeye, invoked through the HTTP endpoint /post/TtsController/textToSpeech. Per the NVD description, the controller passes user-controllable input from the format parameter into a PowerShell command invocation on Windows hosts without adequate sanitization. The specific injection primitive is a single quote (') that allows the attacker to terminate the enclosing PowerShell string literal and append arbitrary command syntax.

This is a classic untrusted-data-to-command-construction defect (CWE-78). The presence of a PowerShell string context indicates that the format value is concatenated into a command line executed by the Skyeye service, likely via a process-spawning API. Because the vulnerable request path is unauthenticated, no credentials, session tokens, or prior access are required to reach the sink — the injection point is directly reachable over the network.

Key structural factors that elevate severity:

• Network reachability: The endpoint is exposed over HTTP (/post/...), so exploitation is remote (AV:N).
• No authentication or interaction: No privileges or user action are required (PR:N, UI:N).
• Full command execution context: Commands execute under the Skyeye service account, not a sandboxed or low-integrity context, enabling broad OS-level operations, tampering, and data access within that account's rights.
• Windows-targeted: The injection is explicitly framed around PowerShell string breakout, so Windows deployment is the affected platform.

Exact controller method signatures, command templates, and argument ordering are not disclosed in the available data and are therefore not asserted here. No patch, advisory, or fix commit has been surfaced by the tracked sources, so the vulnerable code path must be assumed present in the referenced commit and earlier.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification An adversary scans for internet- or intranet-exposed Skyeye deployments, identifying hosts that respond on the web front end and expose the /post/TtsController/textToSpeech route. Shodan-style fingerprinting for Skyeye-specific HTML content or the textToSpeech path can be used to enumerate candidate victims.

2. Triggering the flaw The attacker issues an HTTP POST request to /post/TtsController/textToSpeech with a format parameter crafted to include a single quote. Because the injected quote breaks out of the PowerShell string literal being assembled by the application, anything supplied after the quote is interpreted as PowerShell command syntax rather than passive data.

3. Payload / execution method (class level) The attacker appends shell metacharacters and command syntax through the format parameter so that, once the enclosing PowerShell string is terminated, additional commands execute in the same process context. The specific command-execution operator chain is not documented in available data; the defining capability is arbitrary command execution via quote-based string escape.

4. Post-exploitation impact Successful exploitation runs commands as the Skyeye service account on the Windows host. Depending on that account's privileges, this permits reading and exfiltrating application configuration and data, writing or altering files, establishing persistence (scheduled tasks, services, startup entries), pivoting to other reachable systems, and disrupting the TTS and application services. Because the endpoint is unauthenticated, exploitation can be repeated and scripted against large numbers of instances.

Impact Assessment

The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with subscores C:H/I:H/A:H reflecting total loss of confidentiality, integrity, and availability on the impacted host in the exploit's service-account context. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity, unauthenticated attack requiring no user interaction, scoped to the vulnerable component.

Business impact:

• Service-account compromise: The blast radius is defined by the privileges of the Skyeye service account. If it runs with elevated or broad local rights, an attacker may reach sensitive configuration, credentials, or deployment secrets.
• Internet-exposed risk: Skyeye deployments exposed to untrusted networks are directly exploitable at scale with commodity HTTP tooling.
• Lateral movement and persistence: An interactive command execution primitive is a foothold for further intrusion activity, including credential theft and internal reconnaissance.
• No authentication barrier: The absence of pre-auth requirements removes the need for stolen credentials, lowering the bar for opportunistic attackers and criminal mass-scanning campaigns.

Because no patch exists and no workaround is documented, exposure remains until the vendor delivers a fix or defenders re-architect access to the vulnerable endpoint.

Detection Guidance

Detection strategies should focus on malicious input reaching the unauthenticated TTS endpoint and on suspicious process-spawning behavior from the Skyeye service account.

Sigma Rule

title: Suspicious PowerShell Spawn from Dromara Skyeye Service Account
id: 5a9c1d43-7e2b-4f6a-9c1e-9a3c0f7b2d10
status: experimental
description: Detects PowerShell process creation spawned by a Skyeye service process, consistent with OS command injection in /post/TtsController/textToSpeech (CVE-2026-107780).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107780
author: SOC Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmdline:
    CommandLine|contains:
      - "textToSpeech"
      - "TtsController"
      - "-Command"
  condition: selection_parent and selection_child and selection_cmdline
falsepositives:
  - Legitimate Skyeye internal TTS invocations that use PowerShell
level: high
tags:
  - attack.t1190
  - attack.t1059.001
  - cve.2026-107780

YARA Rule

rule CVE_2026_107780_Skyeye_Tts_CommandInjection
{
    meta:
        description = "Detects HTTP requests abusing the Skyeye /post/TtsController/textToSpeech format parameter for OS command injection (CVE-2026-107780)"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107780"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $path   = "/post/TtsController/textToSpeech" ascii nocase
        $param  = "format=" ascii nocase
        // common PowerShell command-execution indicators following a quote breakout
        $ioc1   = ";" ascii
        $ioc2   = "|" ascii
        $ioc3   = "$(" ascii
        $ioc4   = "`" ascii
        $ioc5   = "Invoke-Expression" ascii nocase
        $ioc6   = "cmd.exe" ascii nocase
        $ioc7   = "powershell" ascii nocase

    condition:
        $path and $param and 2 of ($ioc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107780 Dromara Skyeye TTS OS Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/post/TtsController/textToSpeech"; http.request_body; content:"format="; nocase; pcre:"/format=[^&]*(%27|')/i"; metadata:service http, cve CVE-2026-107780, mitre_tactic_initial_access T1190; classtype:web-application-attack; sid:2026107780; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("java.exe", "javaw.exe") and
  process.name in ("powershell.exe", "pwsh.exe") and
  process.command_line : ("*textToSpeech*", "*TtsController*")

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined
| regex _raw="(?i)/post/TtsController/textToSpeech"
| regex _raw="(?i)format=([^&]*)(%27|')"
| stats count values(uri) as uris values(src_ip) as source_ips by host
| where count > 0

Wazuh OSSEC Rule

<group name="web,skyeye,cve-2026-107780">
  <rule id="100780" level="12">
    <if_sid>31100</if_sid>
    <match>/post/TtsController/textToSpeech</match>
    <match>%27</match>
    <description>CVE-2026-107780: Possible OS command injection via Skyeye textToSpeech format parameter (quote breakout).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107780,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, commit, or workaround is currently identified in the tracked data.

1) Immediate mitigations (no patch available)

• Restrict network access to the /post/TtsController/textToSpeech endpoint at the reverse proxy, WAF, or firewall. If the TTS feature is not required, block the path entirely.
• Require authentication for the endpoint; do not expose it to untrusted networks.
• Deploy WAF rules that inspect the format parameter for single-quote injection patterns and PowerShell metacharacters (;, |, $(, backtick), rejecting matching requests.
• Segment the Skyeye host from sensitive internal networks and enforce least privilege on the service account, limiting its filesystem and process-execution rights.
• Enable process-creation and command-line logging on Windows to capture execution spawned by the Skyeye service account.

2) Patch / upgrade steps

• Because no fixed version exists, monitor the Dromara Skyeye project (commits and releases) for a vendor fix that sanitizes or parameterizes the format parameter and removes PowerShell string concatenation. Upgrade to the first release that contains a fix once published.
• If source access is available, apply a defensive code change: avoid string concatenation into PowerShell commands, use an argument-array invocation approach, and validate/whitelist permitted format values.

3) Long-term hardening

• Adopt a software bill of materials (SBOM) and component tracking to rapidly locate exposed Skyeye deployments.
• Enforce least privilege for all application service accounts and run services in dedicated, low-privilege identities.
• Implement secure development practices that treat all request parameters as untrusted and prohibit shell/process invocation with concatenated input.
• Establish continuous CVE monitoring and a rapid patching workflow for internet-facing applications, and maintain egress and process-integrity telemetry to catch post-exploitation activity.

References

• NVD — CVE-2026-107780: https://nvd.nist.gov/vuln/detail/CVE-2026-107780
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Dromara Skyeye project repository (vendor source; referenced commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321): https://github.com/dromara/skyeye
• CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified in the available data. CVE-2026-107780 is not currently listed in the CISA KEV catalog. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted.