Race Condition Vulnerability in Sparx Pro Cloud Server

CVE-2026-42099

What is CVE-2026-42099?

Sparx Pro Cloud Server is susceptible to a race condition vulnerability in the /data_api/dl_internal_artifact.php endpoint, which can lead to unauthorized remote code execution. An attacker with repository access can exploit this flaw by controlling the name and contents of a PHP file created during the artifact download process. Although the application is designed to delete the malicious file post-processing, a timing issue may arise if transmission delays occur, allowing the file to remain accessible temporarily. During this window, the attacker can launch a second request to execute the malicious PHP file, compromising server security. Current versions confirmed vulnerable are 6.1 (build 167) and below, while other untested versions might also be at risk.

References