EUVD-2026-94982
GHSA-rg38-3cv4-mj9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryAccess unrestricted upload feature
-
ExploitSubmit malicious file bypassing type checks
-
ExecutionInduce victim/app to open file
-
ImpactDisclose or tamper sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid authenticated session on Eimzamip - the CVSS PR:L confirms at least low-privilege credentials are needed, not anonymous access - and (2) access to the product's file-upload functionality, which fails to validate/restrict file type (CWE-434), allowing dangerous file types to be stored. The CVSS UI:R further requires a user interaction (a victim or operator opening or processing the uploaded malicious file) to complete the attack, which limits fully automated exploitation. Scope is unchanged (S:U), confining impact to the vulnerable component. Only versions v1.6.4 up to (but not including) v1.6.6 are affected; upgrading to v1.6.6 removes the condition. |
| Impact | This is a moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3) indicates a network-reachable but authenticated (PR:L) attack that additionally requires user interaction (UI:R), with high confidentiality and integrity impact but no availability impact. Those two preconditions - valid low-privilege credentials AND a user action - materially lower real-world exploitability versus an unauthenticated drive-by flaw. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis and no confirmed active exploitation. Signals are internally consistent (CWE-434 unrestricted file upload aligns with C:H/I:H via planted malicious files), but note a mild tension: unrestricted file-upload flaws frequently enable code execution that would also impact availability (A:H), yet the vendor/TR-CERT vector sets A:N - treat the availability impact as unconfirmed and verify with the vendor. Overall: patch within normal cycles; the authentication + interaction requirement makes mass, automated exploitation unlikely. |
| Exploit ScenarioDerived | An attacker holding a low-privilege account on an Eimzamip instance (v1.6.4-v1.6.5) abuses an upload feature that fails to restrict dangerous file types, uploading a malicious file (e.g., a script or executable payload). A second user or the application then processes/opens the file, leading to disclosure or tampering of sensitive data. No public exploit code is referenced, so exploitation would require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
RemediationAI
Vendor-released patch: v1.6.6 - upgrading Eimzamip from v1.6.4 or v1.6.5 to v1.6.6 (or later) removes the unvalidated-upload condition, and this should be the primary action; confirm the fix and any additional version details in the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275 or through the vendor İzometri IT Services. If immediate upgrade is not possible, apply compensating controls knowing each has trade-offs: enforce a strict server-side allow-list of extensions and MIME types on the upload endpoint (blocks many legitimate non-standard file types and requires business sign-off on the permitted set); store uploaded files outside the web root or in a directory configured with no execute/script-handler permissions (may break preview or download workflows that assume web-reachable paths); disable or sandbox any server-side rendering/parsing of user-supplied documents (reduces feature functionality for document processing); and restrict upload capability to trusted roles plus add malware scanning and upload auditing to catch attempts by low-privilege accounts - though role restriction does not remove the flaw, since PR:L credentials are sufficient for exploitation. Because UI:R is required, reinforcing user awareness around opening unexpected e-signature or document files provides incremental defense against the delivery step. No public exploit code was identified at time of analysis, so prioritization can follow normal patch-cycle cadence rather than emergency change procedures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434, unrestricted upload of a file with a dangerous type: the Eimzamip application accepts attacker-supplied files without enforcing an extension, MIME-type, or content allow-list, so a stored file can carry an executable, script, or otherwise hazardous payload. Eimzamip is a Turkish e-signature/e-imza product from İzometri IT Services Domestic and Foreign Trade Co. Ltd., and this issue was reported through TR-CERT (reference TR-26-1275). The supplied CPE entry cpe:2.3:a:i̇zometri_it_services_domestic_and_foreign_trade_co._ltd.:eimzamip:*:*:*:*:*:*:*:* uses wildcard versioning, so the authoritative version constraint comes from the description: affected releases run from v1.6.4 up to but not including v1.6.6. The assessed vector places the flaw in the network-reachable web/upload layer (AV:N, AC:L) but requires credentials (PR:L) and some form of user interaction (UI:R) to complete the attack chain, and because S:U the impact is confined to the vulnerable Eimzamip component rather than crossing a security boundary. Typical exploitation paths for this class include web-shell placement in an executable directory, client-side payload delivery to an operator who opens the file, or abuse of stored files in downstream document-processing workflows; the CIA impact is rated high for confidentiality and integrity and none for availability.
Know when Eimzamip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network-reachable upload with low-privilege auth (PR:L) and victim action to open the file (UI:R); malicious files yield high confidentiality/integrity impact, no availability impact asserted by the vendor data.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
DescriptionNVD
Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.
This issue affects eimzamip: from v1.6.4 before v1.6.6.
Executive ViewAI
Eimzamip releases before v1.6.6 are affected by a high-severity upload validation weakness that could allow a low-privilege authenticated user to store dangerous files, potentially leading to unauthorized access or alteration of business data if those files are opened by an operator or victim. Although no public exploit has been identified and no active exploitation has been confirmed, the absence of a vendor patch means security management should prioritize reducing exposure and monitoring until a fix is available. The business impact is medium due to the authenticated and user-interaction prerequisites, but the high confidentiality and integrity impact warrants timely action.
No vendor-released patch is identified at time of analysis. Interim mitigations include restricting upload privileges to trusted users, disabling the upload feature where not essential, enforcing file-type and content validation at the web application firewall or reverse proxy, scanning uploaded files with anti-malware and sandboxing before processing, monitoring upload logs for anomalous activity, and training users to avoid opening unexpected files. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB