Unrestricted File Upload Vulnerability in Ocsreports by OCS Inventory NG

CVE-2026-76174

What is CVE-2026-76174?

The Ocsreports application suffers from an unrestricted file upload vulnerability in the admin_info endpoint, specifically concerning CSV file uploads. The application's validation mechanism only checks the file name provided by the user, ignoring the actual content and failing to enforce secure file type restrictions. This flaw permits an authenticated user with administrative privileges to upload potentially malicious PHP files to a web-accessible directory. Should the server process these files, it may result in the execution of arbitrary code with the web service's privileges, posing a significant security risk to the application and its data.

References