EUVD-2026-66344
GHSA-7xv4-f5x2-3xqj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network upload with no user interaction gives AV:N/AC:L/PR:N/UI:N; web-shell RCE yields full C:H/I:H/A:H within the server's scope.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
AnalysisAI
Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB Ver:56) lets remote attackers upload executable web shell backdoors and run arbitrary code on the underlying server. The flaw requires no authentication or user interaction over the network, yielding full compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The required condition is network reachability of EFence's file upload feature - the attacker must be able to reach the upload endpoint and, for full RCE, the uploaded file must land in a location the web/application server will execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals largely agree on high but not maximally urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with no account sends a crafted multipart HTTP POST to EFence's file upload endpoint, submitting a web shell disguised as or delivered as an executable server script. Because the application does not validate file type, the shell lands in a web-accessible path; the attacker then requests its URL to execute commands as the web server user, achieving full RCE. … |
| Remediation | No vendor-released patch version is identified in the available data; the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html and https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html) should be consulted for the vendor-supplied fixed build, since all versions through 1.2.66 (DB Ver:56) are affected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all EFence deployments and their versions; immediately restrict network access to EFence services using firewall rules and network segmentation to trusted administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Thinking Software Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8),
Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8), this vulnerability
SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to u
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote a
Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today