Enterprise Cloud Database CVE-2026-15553

Q: What is the CVSS score of CVE-2026-15553?

CVE-2026-15553 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43272 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 twcert

GHSA-q692-3gm2-wf73

File Upload Enterprise Cloud Database Ragic

6.9

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network vector, no authentication, but UI:R reflects that secondary impact requires a user to download; S:C captures cross-user file delivery risk.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 04:24 vuln.today

DescriptionCVE.org

Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them available for users to download.

AnalysisAI

Unrestricted file upload in Ragic Enterprise Cloud Database exposes all versions to unauthenticated remote exploitation, allowing attackers to plant malicious files that are subsequently served to authenticated platform users for download. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the application performs no meaningful validation of file type, content, or extension before persisting uploads. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the zero-authentication requirement and network-accessible attack vector make this a low-barrier, high-supply-chain-risk issue in environments where Ragic is used for file collaboration.

Technical ContextAI

Ragic Enterprise Cloud Database is a no-code/low-code cloud-hosted database platform (CPE: cpe:2.3:a:ragic:enterprise_cloud_database:*:*:*:*:*:*:*:*) that supports file attachment and sharing workflows typical of enterprise data management tools. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes a failure to enforce server-side controls on file upload endpoints - neither MIME type validation, file extension allowlisting, nor content inspection is applied. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the file upload endpoint is exposed over the network without any authentication gate. The integrity impact is assessed as low at the vulnerable-system level (VI:L), but the secondary risk - malicious files propagated to and executed by end users - is not fully captured by the base metrics alone. Reported by Taiwan CERT (TWCERT).

RemediationAI

The primary remediation is to apply the vendor-released patch or configuration update described in the TWCERT advisories at https://www.twcert.org.tw/en/cp-139-11032-460c2-2.html - an exact fixed version number is not independently confirmed from available data, so administrators should consult Ragic directly for the patched build. If immediate patching is not possible, compensating controls should include restricting access to the file upload endpoint at the network perimeter (e.g., blocking unauthenticated POST requests to upload paths via WAF or reverse proxy rules), enforcing server-side file type allowlisting to reject executables, scripts, and Office macro-enabled formats, and enabling antivirus scanning on uploaded file storage. Trade-offs: blocking unauthenticated uploads may break guest or public submission workflows. File type allowlisting requires careful enumeration of legitimate use cases to avoid disrupting operations. Regardless of patch status, user awareness should be raised: files downloaded from the platform should not be executed without out-of-band verification until the fix is confirmed deployed.