PT-2026-130648

CVE-2026-115245

Published

2026-10-27

Updated

2026-11-01

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chat AI with Dispatcher versions prior to 2.4

Description An issue exists where uploaded files are not properly validated, as the system relies solely on a spoofable client-supplied content type. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, which can lead to remote code execution (the ability to execute arbitrary commands on the server).

Recommendations Update to version 2.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration