CVE-2026-76174

Name of the Vulnerable Software and Affected Versions Ocsreports (affected versions not specified)

Description An unrestricted file upload issue exists in the CSV file upload functionality of the 'admin info' endpoint. The application validates files based only on the client-provided name, failing to verify content or restrict file types. This allows a user with administrator privileges to upload PHP files to a web-accessible directory, potentially leading to arbitrary code execution with the privileges of the web service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.