Reminiscence 0.3.0 stores an authenticated user's download_manager setting and later executes it through Windows shell-based subprocess paths. A user who controls that setting can inject commands when media archiving or export functionality invokes the configured downloader.
The settings update flow in pages/views.py accepts req_set_settings=yes and stores the submitted download_manager value for the user. Later, media archiving and export helpers in pages/dbaccess.py format that stored value with fields such as {iurl} and {output}.
On Windows, the resulting string is passed to subprocess helpers with shell=True. The missing boundary is validation that download_manager is a safe executable path and argument template before it becomes a shell command.
The issue requires an authenticated account that can save the setting and a Windows deployment path that invokes the stored downloader. Non-Windows execution paths are not part of this command-injection claim.
- Log in to Reminiscence 0.3.0 on a Windows deployment as a user who can update personal settings.
- Submit the settings update path with
req_set_settings=yesand setdownload_managerto a value containing a command separator followed by a harmless marker command. - Add or archive a URL through a feature that invokes the configured download manager and formats
{iurl}and{output}into the command string. - Let the archiving or export action run under the server process.
- Observe the marker command execute, for example by creation of a marker file under a path writable by the Reminiscence process.
The observed result is authenticated command execution on Windows deployments. The command runs with the privileges of the Reminiscence server process and is limited to feature paths that invoke the stored download_manager setting.