File Upload Exploit in Affected Product by Vendor

CVE-2026-90445

What is CVE-2026-90445?

The vulnerability affects an interface that allows file uploads from authenticated users. It improperly handles the extraction of files from uploaded archives, failing to validate that the extracted file paths are confined to the intended destination. Consequently, an authenticated attacker can create a specially crafted archive that directs the extraction process to write files beyond the designated directory. This oversight enables the potential for an attacker to manipulate stored data or alter application configurations, leveraging the privileges of the extraction process.

References