File Transfer Vulnerability in Product A by Vendor B

CVE-2026-90444

What is CVE-2026-90444?

A vulnerability exists in Product A that involves a file-transfer interface requiring valid credentials but allows attacker-controlled filenames without shell metacharacters restriction. This design flaw enables an authenticated attacker to craft malicious file names, leading to the execution of arbitrary system commands with the associated process's privileges. Such exploitation can grant attackers the ability to manipulate log data and facilitate further infiltration into the internal network.

References