Remote Command Execution Vulnerability in mpGabinet by mpGabinet

CVE-2026-40552

What is CVE-2026-40552?

mpGabinet is susceptible to a Remote Command Execution vulnerability where authenticated users with backend database access can execute system commands. By uploading an attachment and altering its storage path to reference a remote resource under the attacker's control, or by modifying a previously uploaded file's reference, an attacker can exploit this vulnerability when the attachment is processed. Additionally, this vulnerability can be escalated by chaining it with other vulnerabilities to gain unauthorized database access and account login capabilities, making it a significant security risk.

References