EUVD-2026-63566
GHSA-cxgp-6h9c-hfpc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity file upload requiring an admin account (PR:H); RCE breaking out of the app to the host justifies S:C with full C/I/A impact.
Primary rating from Vendor (kaspersky).
CVSS VectorVendor: kaspersky
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
AnalysisAI
Arbitrary file upload leading to remote code execution in vsDesk v14.0101 lets an authenticated administrator abuse the "Import via CSV" component, which relies solely on client-side file validation and performs no server-side extension or content checks. Because the check is enforced only in the browser, an admin can trivially submit a malicious file (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with administrative privileges in vsDesk (CVSS PR:H) and access to the "Import via CSV" feature; the specific weakness is that file-type validation exists only client-side, so the attacker must submit the upload directly to the server (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to a serious but privilege-gated issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch by upgrading to vsDesk 14.0402 or later (Vendor-released patch: 14.0402), obtained from https://vsdesk.ru/ and referenced in the release notes at https://vsdesk.ru/news/vyshla-novaya-versiya-140422; the associated Kaspersky advisory is at https://github.com/klsecservices/Advisories/blob/master/KLSA-00415-Missing-Server-Side-File-Extension-Validation-in-vsDesk.md. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all vsDesk deployments, identify systems running v14.0101, disable or restrict admin access to CSV import functionality, and audit recent admin import activities for suspicious files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today