CVE-2021-45844

What it actually does

Improper sanitization of filenames passed to the ODA File Converter allows arbitrary operating system command execution when FreeCAD processes a maliciously named file.

Why it matters to the business

Attackers can gain full control of the workstation running the affected CAD software, enabling theft of design data, installation of persistent malware, or lateral movement inside engineering environments.

How an attack unfolds

An attacker creates a file with a filename containing shell metacharacters or command separators. When a user opens or imports the file in FreeCAD, the application invokes the ODA File Converter without sanitizing the filename, causing the injected commands to execute with the privileges of the FreeCAD process.

How to fix it

Upgrade FreeCAD to a version that properly sanitizes filenames before invoking external converters. Where an upgrade is not immediately possible, disable or remove the ODA File Converter integration and restrict opening of untrusted files.

How to confirm the fix worked

Confirm the installed FreeCAD version is newer than 0.19 and test that filenames containing shell metacharacters no longer result in command execution when the converter is invoked.

Typical attack path

1. Attacker crafts a file whose name embeds OS command injection syntax
2. Victim receives and opens the file in FreeCAD 0.19
3. FreeCAD passes the unsanitized filename to the ODA File Converter
4. Operating system executes the attacker-supplied commands
5. Attacker obtains code execution on the local system

How to detect it

Review process creation and command-line logs on systems where FreeCAD runs; look for freecad spawning shell interpreters or external converter processes with unusual arguments containing pipes, semicolons, or redirection operators.

• freecad.*oda_file_converter.*[;&|`$]
• process_name:sh.*-c.*freecad
• filename containing | or ; passed to converter

What your security team should do

• Apply the latest FreeCAD release across all engineering workstations
• Block execution of untrusted .FCStd and related CAD files via application allow-listing or sandboxing
• Monitor process creation events from freecad for suspicious child processes or command lines containing shell operators