Skip to main content

EFence CVE-2026-80237

| EUVDEUVD-2026-66346 HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-08-26 twcert GHSA-5w42-7c8c-6jj3
File Upload RCE Efence
8.7
CVSS 4.0 · Vendor: twcert
Share

Severity by source

Vendor (twcert) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-accessible upload endpoint exploitable with low-privilege credentials; no scope change per CVSS 4.0 SC:N metrics; full C/I/A from arbitrary web shell execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Aug 26, 2026 - 16:01 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 26, 2026 - 15:52 vuln.today
cvss_changed
CVSS changed
Aug 26, 2026 - 15:52 NVD
8.8 (HIGH) 8.7 (HIGH)
Analysis Generated
Aug 26, 2026 - 09:21 vuln.today
CVE Published
Aug 26, 2026 - 08:28 cve.org
HIGH 8.8

DescriptionCVE.org

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

AnalysisAI

Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote attackers to upload web shell backdoors and achieve full arbitrary code execution on the underlying server. The CVSS 4.0 score of 8.7 reflects network-accessible exploitation requiring only low-privilege credentials, with confirmed total technical impact per SSVC. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid low-privilege EFence credentials
Delivery
Craft upload request containing web shell file
Exploit
Submit request to EFence upload endpoint
Execution
Server stores executable web shell without restriction
Persist
Attacker sends HTTP request to uploaded shell URL
Impact
Execute arbitrary OS commands on server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires valid credentials to the EFence application at a low-privilege level (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network accessibility with low attack complexity and no special attack requirements, requiring only low-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or guessed valid low-privilege EFence credentials - through credential stuffing, phishing, or insider access - sends a crafted HTTP upload request to EFence's upload endpoint, submitting a web shell script disguised or unrestricted by the application's validation logic. Once uploaded, the attacker directly requests the web shell's URL to execute arbitrary operating system commands with the permissions of the EFence web server process. …
Remediation Consult the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html and https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html for vendor-issued patch guidance; a specific patched release version is not independently confirmed in the available data, so contacting Thinking Software Technology directly for the updated build is recommended. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all EFence deployments, document current versions, and audit which user accounts have file upload privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Efence

View all
CVE-2023-32754 CRITICAL
9.8 Jun 16

Thinking Software Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8),

CVE-2023-22900 CRITICAL
9.8 Jan 31

Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2026-80235 CRITICAL
9.3 Aug 26

Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB

CVE-2026-80236 HIGH
8.8 Aug 26

SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to u
CVE-2014-4526 MEDIUM POC
4.3 Jul 02

Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

CVE-2026-80237 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy