Command injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute arbitrary Java code via a crafted path that matches the improperly…

A command injection vulnerability in Raynet rvia version 12.6.4392.49-amd64.deb allows attackers to execute arbitrary Java code. The vulnerability exists due to improperly terminated search criteria in rvia's Java search functionality using the find command. Adversaries can exploit this by crafting malicious file paths that match the vulnerable search criteria. This enables remote code execution through command injection attacks. The vulnerability has been assigned CVE-2026-38945 and proof-of-concept code is publicly available.