What is the CVSS score of CVE-2026-51924?

CVE-2026-51924 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-51924?

docuForm GmbH Client v11.11c contains a high-severity vulnerability (CVSS 8.1) enabling authenticated users to upload and execute code on the server.

How to fix or mitigate CVE-2026-51924?

Within 24 hours: inventory all systems running docuForm Client v11.11c; restrict access to the report.php upload endpoint via firewall or WAF; review recent report.php access logs for suspicious uploads. Within 7 days: implement strict file-type and file-size restrictions on the upload handler; deploy WAF rules to detect and block malicious file uploads; enable detailed logging and real-time alerting on report.php access. Within 30 days: obtain and apply vendor patch from docuForm GmbH when available, or upgrade to a patched version; conduct post-deployment security testing; establish ongoing monitoring for exploitation attempts.

PHP CVE-2026-51924

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 cve@mitre.org

PHP Authentication Bypass RCE File Upload

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:26 vuln.today

CVSS changed

Jul 10, 2026 - 16:22 NVD

8.1 (HIGH)

CVE Published

Jul 09, 2026 - 21:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component

AnalysisAI

Authenticated remote code execution in docuForm GmbH Client v11.11c lets low-privileged users abuse the report.php file-upload component to run arbitrary code on the server. The flaw combines an authorization-bypass weakness (CWE-639) with unrestricted file upload, so an attacker with any valid account can escalate to full server compromise. No public exploit identified at time of analysis, though a third-party gist referenced in NVD may contain technical write-up material; EPSS is low (0.24%, 15th percentile) and the CVE is not in CISA KEV.