CyberRota Yorumu
Uzaktan istismar edilebilir olabilir.
Public Exploit Sinyali
Bu CVE için açıklama veya referanslarda public exploit / PoC / GitHub / Metasploit sinyali tespit edildi.
Tespit Edilen Sinyaller
remote code execution code execution
GitHub PoC Linkleri
Not: Bu bağlantılar yalnızca güvenlik araştırması ve doğrulama amacıyla listelenmiştir.
CVE
CVE-2026-40521
Severity
HIGH
CVSS
8.8
EPSS
%0.63
Orijinal NVD Açıklaması
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.