freecad - Debian Package Tracker

general

source: freecad (main)
version: 1.1.3+dfsg-3
maintainer: FreeCAD Packaging Team (DMD)
uploaders: Kurt Kremitzki [DMD] – Tobias Frost [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.19.1+dfsg1-2+deb11u1
o-o-sec: 0.19.1+dfsg1-2+deb11u1
oldstable: 0.20.2+dfsg1-4
stable: 1.0.0+dfsg-8+deb13u2
stable-sec: 1.0.0+dfsg-8+deb13u3
unstable: 1.1.3+dfsg-3

versioned links

0.19.1+dfsg1-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.20.2+dfsg1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.0+dfsg-8+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.0+dfsg-8+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.3+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

freecad (5 bugs: 0, 5, 0, 0)
freecad-common
freecad-python3
libfreecad-python3

action needed

debian/patches: 1 patch with invalid metadata, 1 patch to forward upstream high

Among the 8 debian patches available in version 1.1.3+dfsg-3 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-06-20 Last update: 2026-08-28 20:00

6 security issues in bullseye high

There are 6 open security issues in bullseye.

6 important issues:

CVE-2026-34398: FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.
CVE-2026-34399: FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.
CVE-2026-34789: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
CVE-2026-73233: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.
CVE-2026-73234: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.
CVE-2026-73235: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.

Created: 2026-08-12 Last update: 2026-08-28 18:30

6 security issues in bookworm high

There are 6 open security issues in bookworm.

6 important issues:

CVE-2026-34398: FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.
CVE-2026-34399: FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.
CVE-2026-34789: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
CVE-2026-73233: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.
CVE-2026-73234: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribute and ZIP entry can therefore write attacker-controlled content to arbitrary locations accessible to the FreeCAD user, potentially enabling persistence, credential compromise, configuration replacement, or code execution. This issue is fixed in version 1.1.2.
CVE-2026-73235: FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity resolution or external DTD loading. When Document::restore() opens the document, external entities can read local files through the file URI scheme or initiate server-side requests through the http URI scheme, and resolved content can flow through the characters() callback. This issue is fixed in version 1.1.2.

Created: 2026-08-12 Last update: 2026-08-28 18:30

Depends on packages which need a new maintainer normal

The packages that freecad depends on which need a new maintainer are:

med-fichier (#1141085)
- Depends: libmedc11t64
- Build-Depends: libmedc-dev

Created: 2026-06-29 Last update: 2026-08-30 04:00

lintian reports 76 warnings normal

Lintian reports 76 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-28 Last update: 2026-08-28 22:49

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.1.3+dfsg-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 1037713bb8f4a5f4144ad46f43a90a8e076b2b05
Author: Tobias Frost <tobi@debian.org>
Date:   Fri Aug 28 14:13:34 2026 +0200

    Recommend python3-pyside6.qtsvgwidgets to avoid python error on the BIM workbench, thanks to Luke for the report. Closes #1143819

commit f3b67f8b2bc7b2481cdd003e1ac40e45f474dbd6
Author: Tobias Frost <tobi@debian.org>
Date:   Fri Aug 28 11:00:58 2026 +0200

    Release freecad (1.1.3+dfsg-3)

commit b9532a950ee6c139752ef3363d629d58e89cc34c
Author: Tobias Frost <tobi@debian.org>
Date:   Thu Aug 27 22:34:33 2026 +0200

    limit build autopkgtest to amd64 (Closes: #1145879)

https://salsa.debian.org/api/v4/projects/debian%2Ffreecad API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-27 Last update: 2026-08-28 16:33

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-08-28 18:23

testing migrations

This package will soon be part of the auto-zipios++ transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-fmtlib transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-xerces-c transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migrates after: med-fichier
- Migration status for freecad (- to 1.1.3+dfsg-3): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for freecad/1.1.3+dfsg-3: amd64: Pass, arm64: Test triggered, armhf: Pass, loong64: Pass, ppc64el: Pass, riscv64: Test triggered
- ∙ ∙ Too young, only 2 of 5 days old
- ∙ ∙ Build-Depends(-Arch): freecad med-fichier (not considered)
- ∙ ∙ Depends: freecad med-fichier (not considered)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/f/freecad.html
- ∙ ∙ Autopkgtest skipped on i386: not installable (which is allowed)
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-08-28] Accepted freecad 1.1.3+dfsg-3 (source) into unstable (Tobias Frost)
[2026-08-26] Accepted freecad 1.0.0+dfsg-8+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Aron Xu)
[2026-08-23] Accepted freecad 1.1.3+dfsg-2 (source) into unstable (Tobias Frost)
[2026-08-22] Accepted freecad 1.1.3+dfsg-1 (source) into unstable (Tobias Frost)
[2026-08-10] freecad REMOVED from testing (Debian testing watch)
[2026-07-15] freecad 1.1.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-07-04] Accepted freecad 1.0.0+dfsg-8+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Petter Reinholdtsen)
[2026-06-26] Accepted freecad 1.1.1+dfsg-3 (source) into unstable (Tobias Frost)
[2026-06-08] Accepted freecad 1.0.0+dfsg-8+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Petter Reinholdtsen)
[2026-05-15] freecad 1.1.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-05-07] Accepted freecad 1.1.1+dfsg-2 (source) into unstable (Tobias Frost)
[2026-05-06] Accepted freecad 1.1.1+dfsg-2~exp1 (source) into experimental (Tobias Frost)
[2026-05-06] Accepted freecad 1.1.1+dfsg-1 (source) into unstable (Tobias Frost)
[2026-05-04] freecad REMOVED from testing (Debian testing watch)
[2026-04-26] freecad 1.1.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-04-23] Accepted freecad 1.1.0+dfsg-2 (source) into unstable (Tobias Frost)
[2026-04-22] Accepted freecad 1.1.0+dfsg-2~exp1 (source) into experimental (Tobias Frost)
[2026-03-29] Accepted freecad 1.1.0+dfsg-1 (source) into unstable (Tobias Frost)
[2026-03-22] Accepted freecad 1.0.2+dfsg-8~exp1 (source) into experimental (Tobias Frost)
[2026-03-09] freecad 1.0.2+dfsg-7 MIGRATED to testing (Debian testing watch)
[2026-03-05] Accepted freecad 1.0.2+dfsg-7 (source) into unstable (Tobias Frost)
[2026-03-05] freecad 1.0.2+dfsg-6 MIGRATED to testing (Debian testing watch)
[2026-03-02] Accepted freecad 1.0.2+dfsg-6 (source) into unstable (Tobias Frost)
[2026-02-27] Accepted freecad 1.0.2+dfsg-5 (source) into unstable (Tobias Frost)
[2026-02-26] Accepted freecad 1.0.2+dfsg-4 (source) into unstable (Tobias Frost)
[2026-02-24] Accepted freecad 1.0.2+dfsg-3 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2025-10-23] freecad 1.0.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-10-19] Accepted freecad 1.0.2+dfsg-2 (source) into unstable (Tobias Frost)
[2025-10-09] freecad 1.0.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-10-05] Accepted freecad 1.0.2+dfsg-1 (source) into unstable (Tobias Frost)

bugs [bug history graph]

all: 5
RC: 0
I&N: 5
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 76)
buildd: logs, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches
debci