EUVD-2026-63792
GHSA-fgmq-h6gh-p5x7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication enforced on network-accessible upload API (PR:N, AV:N); arbitrary file write yields high integrity and availability impact with no confidentiality breach.
Primary rating from Vendor (ZUSO ART).
CVSS VectorVendor: ZUSO ART
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
AnalysisAI
Unauthenticated arbitrary file upload in Datiphy Data Management Center v8.3.0 through v8.5.1 exposes the upload API endpoint without any authentication enforcement, permitting remote attackers to write arbitrary files directly to the server's configured upload directory. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by ZUSO ART and registered as ENISA EUVD-2026-63792. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation beyond network connectivity to the upload API endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) represents a high-priority exploit scenario: no authentication, no complexity, no user interaction, network-reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network-level access to the Data Management Center instance sends a crafted multipart/form-data HTTP POST request directly to the unauthenticated upload API endpoint, supplying an arbitrary file such as a web shell. The server accepts the file without challenging for credentials and writes it to the configured upload directory. … |
| Remediation | No vendor-released patch version has been identified in the available intelligence at time of analysis; consult the ZUSO ART advisory at https://zuso.ai/advisory and contact Datiphy Inc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Datiphy Data Management Center v8.3.0-v8.5.1 and restrict the upload API endpoint to trusted networks only using firewall or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Data Management Center
View allOS command injection in the Datiphy Data Management Center API endpoint (versions v8.3.0 through v8.5.1) lets an authent
Arbitrary file write in Datiphy Data Management Center versions 8.3.0 through 8.5.1 lets a remote, unauthenticated attac
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log int
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today