Vertigis Fm CVE-2026-0522

VertiGIS FM is an ASP.NET-based web application that handles file upload and download operations. The vulnerability stems from improper path validation during the upload/download flow (CWE-610: Externally Controlled Reference to a Resource in Another Sphere). Attackers with valid credentials can manipulate file path parameters during upload to reference arbitrary locations on the server's filesystem. When the file is subsequently downloaded, the application returns the file at the attacker-specified path rather than the legitimate upload location. Because VertiGIS FM runs on ASP.NET, obtaining sensitive configuration files like web.config-which contains database credentials, encryption keys, and other sensitive settings-could enable code execution through config-based attacks. Additionally, the application's resolution of UNC (Universal Naming Convention) paths creates a secondary attack vector for NTLM-relay attacks, where an attacker can coerce the server into authenticating to an attacker-controlled network resource, potentially leading to credential theft or lateral movement.