PT-2026-79088 · Vsdesk · Vsdesk
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
vsDesk versions prior to 14.0402
Description
An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component because the server fails to perform its own validation. This flaw allows the upload of arbitrary files, potentially leading to Remote Code Execution (RCE), which is the ability to execute malicious commands on the host machine, within the context of the web application.
Recommendations
Update to version 14.0402 or later.
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vsdesk