Verified reproduction
CVE-2026-58126: PACSgear PACS Scan unauthenticated remote code execution
CVE-2026-58126 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00235.
Severity CRITICAL
Confidence HIGH
Reproduced in 64m 7s
Tool calls 330
Spend $23.94
$
pruva-verify REPRO-2026-00235 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00235/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability. Reproduce: deploy PACS Scan 5.2.1, send a crafted unauthenticated request to the vulnerable endpoint, and confirm arbitrary code execution on the host.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/logs/exploit_client.log2.7 KBbundle/logs/target_service_exploited.log0.8 KBbundle/logs/target_service_clean.log0.5 KBbundle/logs/vulnerable_server.log0.5 KBbundle/artifact_promotion_manifest.json17.3 KBbundle/vuln_variant/root_cause_equivalence.json1.5 KBbundle/repro/reproduction_steps.sh19.9 KBbundle/repro/runtime_manifest.json2.2 KBbundle/repro/rca_report.md11.7 KBbundle/repro/validation_verdict.json0.9 KBbundle/repro/artifacts/pacs_scan_appdir/RCE_PROOF_CODE_EXECUTION.txt0.2 KBbundle/repro/artifacts/pacs_scan_appdir/CVE-2026-58126-PROOF.txt0.2 KBbundle/repro/artifacts/pacs_scan_appdir/CRYPTSP.DLL0.2 KBbundle/logs/product_attempt_1_exploit.log2.0 KBbundle/logs/product_attempt_1_service.log0.7 KBbundle/repro/artifacts/product_attempt_1/rce_marker.txt0.1 KBbundle/logs/product_availability.log0.7 KBbundle/logs/reproduction_steps.log14.1 KBbundle/logs/product_static_identity.log6.4 KBbundle/logs/product_attempt_1_server.log1.3 KBbundle/logs/product_attempt_1_negative_service.log0.6 KBbundle/logs/product_attempt_2_server.log1.3 KBbundle/logs/product_attempt_2_exploit.log2.0 KBbundle/logs/product_attempt_2_service.log0.6 KBbundle/logs/product_attempt_2_negative_service.log0.6 KBbundle/logs/wine_dotnet_setup.log0.1 KBbundle/repro/artifacts/product_identity.json0.9 KBbundle/repro/artifacts/product_attempt_1/remote_read_win_ini.txt0.2 KBbundle/repro/artifacts/product_attempt_1/remote_write_proof.txt0.1 KBbundle/repro/artifacts/product_attempt_1/cryptsp_upload.txt0.2 KBbundle/repro/artifacts/product_attempt_1/service_overwrite_upload.txt0.2 KBbundle/repro/artifacts/product_attempt_2/remote_read_win_ini.txt0.2 KBbundle/repro/artifacts/product_attempt_2/remote_write_proof.txt0.1 KBbundle/repro/artifacts/product_attempt_2/rce_marker.txt0.1 KBbundle/repro/artifacts/product_attempt_2/cryptsp_upload.txt0.2 KBbundle/repro/artifacts/product_attempt_2/service_overwrite_upload.txt0.2 KBbundle/vuln_variant/variant_manifest.json4.2 KBbundle/vuln_variant/validation_verdict.json3.3 KBbundle/vuln_variant/rca_report.md9.8 KBbundle/vuln_variant/patch_analysis.md6.8 KBbundle/logs/vuln_variant/reproduction_steps.log12.8 KBbundle/vuln_variant/reproduction_steps.sh11.2 KBbundle/vuln_variant/runtime_manifest.json1.1 KBbundle/logs/vuln_variant/vulnerable_static_scan.log2.5 KBbundle/logs/vuln_variant/service_candidate_scan.log5.8 KBbundle/logs/vuln_variant/service_onstart_script.log0.2 KBbundle/logs/vuln_variant/fixed_latest_check.log3.7 KBbundle/logs/vuln_variant/latest_version.txt0.7 KB