Sparx Pro Cloud Server CVE-2026-42099

Requires authenticated access to the Sparx Pro Cloud Server repository (CVSS PR:L) sufficient to invoke /data_api/dl_internal_artifact.php and supply a guid pointing to an attacker-controlled object whose properties include both filename and contents. The attacker must also be able to influence transmission timing - typically by uploading or referencing a large artifact, or by throttling their own TCP receive window - to keep the staged .php file on disk long enough for a parallel request to fetch it (CVSS AC:H attack complexity and AT:P attack requirement reflect this race window). Limiting factors: requires a valid repository account (not anonymous), requires the deployment to expose the dl_internal_artifact.php endpoint to the attacker's network path, requires the PHP interpreter to execute files in the directory where artifacts are temporarily written, and success is probabilistic per attempt because the window closes when cleanup completes.

CVSS 4.0 scores this 7.7 (High) with vector AV:N/AC:H/AT:P/PR:L/UI:N - network reachable but with high attack complexity, a present attack requirement (the race window), and low privileges (an authenticated repository user). Confidentiality, integrity, and availability impact on the vulnerable system are all High, with low subsequent-system impact. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit identified at time of analysis, though three independent technical write-ups (CERT-PL, sploit.tech, efigo.pl) describe the bug in detail, which materially lowers the cost of weaponization. Realistic priority is moderate-to-high for any organization exposing Pro Cloud Server to untrusted or semi-trusted repository users; it is lower for hardened, internal-only deployments where repository accounts are tightly controlled. Key missing data: vendor never confirmed the full vulnerable version range, so versions above 6.1 build 167 are of unknown status - a meaningful gap for patch planning.

An attacker with a valid low-privilege repository account on a publicly reachable Pro Cloud Server crafts a request to /data_api/dl_internal_artifact.php with a guid pointing to an object whose name is a .php file and whose contents are a PHP webshell. They artificially slow the download (large payload or throttled TCP receive window) to widen the post-write, pre-delete race window, then issue a parallel HTTP request to fetch the staged .php file, triggering execution as the web server user. Detailed write-ups exist on cert.pl, sploit.tech, and efigo.pl, lowering the engineering effort to reproduce.