PT-2026-145021

CVE-2026-121497

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AskAny versions prior to 2.2.0

Description Unauthenticated users can upload PHP files and execute arbitrary code on the site server when visitor attachments are enabled. This occurs because the plugin fails to validate the extension or content of files attached to chat messages, relying instead on the file type supplied by the browser.

Recommendations Update to version 2.2.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers