mpGabinet CVE-2026-40552

Direct database access to the attachment storage path table is required. For authenticated exploitation, the attacker must be a database administrator or have the application-level privilege to upload attachments and the ability to query/modify the database (not default permissions). For unauthenticated exploitation, the attacker must first chain CVE-2026-40550 (method of obtaining database access not specified in provided data) and CVE-2026-40551 (account takeover mechanism not specified in provided data) to establish database and application access. User interaction is required: a legitimate user must attempt to open or download the manipulated attachment to trigger the resource retrieval and execution. The vulnerability is limited to mpGabinet 23.12.19 and below; patched versions are assumed to implement attachment path validation. Exploitation does NOT require network access directly to the vulnerable application (AV:A suggests adjacent network only, though this is questionable given the description), but does require network connectivity from the mpGabinet server to the attacker-controlled resource hosting the malicious file.

The CVSS 4.0 score of 4.7 reflects a low base severity due to constraints in the CVSS vector: attack vector is Adjacent (AV:A, requiring network proximity), high privilege requirement (PR:H), and required user interaction (UI:P). However, this score significantly underrepresents real-world risk because the vulnerability becomes unauthenticated and bypasses all these constraints when chained with CVE-2026-40550 and CVE-2026-40551. The description explicitly states that unauthenticated attackers can obtain database access and account takeover via those companion CVEs, which eliminates the AV:A, PR:H, and UI:P protections, transforming this into a network-accessible, unauthenticated, privileged remote code execution. The Tags field indicates 'Information Disclosure' which may be incomplete or refer to secondary impacts from the companion CVEs. EPSS score is unavailable, but exploitation likelihood is high given that three CVEs targeting the same application exist in rapid succession, suggesting active development of exploit chains. The UI:P constraint is less restrictive than it appears-users routinely open email attachments and document files, making user interaction a weak control. Real-world priority should be CRITICAL when chained vulnerabilities are accessible; the base CVE-2026-40552 alone rates as MEDIUM to HIGH depending on database access controls in the target environment.

An attacker obtains initial database access through CVE-2026-40550 and uses CVE-2026-40551 to log in as any mpGabinet user. The attacker then queries the database to identify existing file attachments and modifies the storage path of a document attachment (e.g., from /var/mpgabinet/files/document.pdf to \\attacker-smb-server\\malware.exe). When a legitimate user opens this attachment through the mpGabinet interface, the application retrieves the reference from the database, follows the modified path to the attacker-controlled SMB server, downloads and executes the malware with system privileges. Alternatively, the attacker uploads a new attachment and immediately modifies its database entry to point to the attacker's resource before any user accesses it.