vsDesk CVE-2026-2334

Exploitation requires an authenticated account with administrative privileges in vsDesk (CVSS PR:H) and access to the "Import via CSV" feature; the specific weakness is that file-type validation exists only client-side, so the attacker must submit the upload directly to the server (e.g. via an intercepting proxy or crafted HTTP request) to bypass the browser check. Limiting factors: administrative authentication is mandatory (this is not exploitable by anonymous or low-privileged users), and the target must be a vulnerable build (14.0101 through the release prior to 14.0402). No user interaction by a victim is needed (UI:N), and the vector is network-reachable (AV:N), but the admin-privilege prerequisite is the primary constraint on realistic exploitation.

The signals are internally consistent and point to a serious but privilege-gated issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC/VI/VA and subsequent-system SC/SI/SA all High, score 9.4) reflects network reachability, low complexity, no user interaction, and full compromise of the host and beyond - but crucially PR:H, meaning the attacker must already hold administrative privileges in vsDesk. This is the dominant limiting factor: it is a privilege-escalation-to-code-execution primitive (admin over the app to code execution on the server), not an unauthenticated internet-facing RCE, so mass, opportunistic exploitation is unlikely. There is no CISA KEV listing and no public proof-of-concept identified, so exploitation is neither confirmed active nor proven trivial in the wild; the high CVSS is driven by impact, not by ease of unauthenticated access. Real priority is high for any organization actually running vsDesk (a compromised or malicious admin, or an admin session hijacked via another bug, converts directly to server takeover), but the required admin privilege meaningfully narrows the realistic threat population compared to a raw 9.4 reading.

An attacker who already holds (or has phished/hijacked) a vsDesk administrator account opens the "Import via CSV" feature, intercepts the upload request with a proxy, and replaces the CSV with a server-side script such as a PHP web shell. Because the server performs no extension or content validation, the file is stored and can then be requested directly to execute arbitrary code in the web application's context. No public proof-of-concept is currently identified, but the low attack complexity means exploitation is straightforward once admin access is obtained.