EUVD-2026-88171
GHSA-468q-55rr-hw4m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryAccess unvalidated file-upload feature
-
ExploitUpload web shell as document
-
ExecutionRequest shell via HTTP
-
PersistExecute code as web server
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on eBA Plus Document and Workflow Management System, versions from 6.7.141 up to but not including 10.0.11, with access to a document/file-upload function that does not restrict dangerous file types. The attacker must be able to upload a server-executable file and reach the uploaded artifact via a web-accessible path. Limiting factors: valid credentials or a self-registration path are needed (not unauthenticated), and installations already on 10.0.11 or later are not affected; the exact upload endpoint and required role are not detailed in the advisory. |
| Impact | This is a genuine high-priority issue for organizations running the affected product. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with a CWE-434 unrestricted file upload leading to web shell deployment: network-reachable, low attack complexity, requiring only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality/integrity/availability impact via remote code execution. I concur with the 8.8 rating. However, key exploitation signals are ABSENT from the provided intelligence: no EPSS probability was supplied, the CVE is NOT listed in CISA KEV, and no public POC/exploit reference is present - the only reference is the TR-CERT advisory (tr-26-1197). Therefore exploitation status is 'no public exploit identified at time of analysis' despite the high impact. The gap between a very damaging technical outcome (RCE web shell) and the lack of any exploitation-maturity data means priority should be driven by impact-plus-exposure rather than confirmed active abuse. Note also that PR:L means an attacker still needs valid low-privilege credentials or a registration path to reach the upload feature - a meaningful mitigating factor absent an unauthenticated bypass. |
| Exploit ScenarioDerived | An authenticated low-privilege user of eBA Plus abuses a document/workflow file-upload feature that fails to validate file type, uploading a server-executable web shell (e.g., an ASP.NET/.aspx handler) into a web-accessible directory. The attacker then requests the uploaded shell over HTTP to execute arbitrary commands on the server, achieving full compromise. No public POC was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Authenticated abuse of the document upload function in eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) lets a low-privilege user place a Web Shell on the server and, if the uploaded file can be reached through a web-accessible path, run code with the privileges of the web application. The defect is CWE-434 (unrestricted upload of a file with a dangerous type) and carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so valid credentials or a self-registration path are required rather than unauthenticated access, and installations already on 10.0.11 or later are outside the affected range. No public exploit has been identified at time of analysis; TR-CERT (Turkish national CERT) is the reporting and reference source. This is a genuine high-priority issue for organizations running the affected product.
RemediationAI
Upgrade eBA Plus Document and Workflow Management System to 10.0.11 or later, the first version outside the affected range stated in the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1197); this is the primary and complete fix, and vendor-released patch availability should be confirmed with Bimser Solution Software Trade Inc. for the specific build in use. Where upgrading cannot be completed immediately, apply compensating controls with their trade-offs understood: enforce a server-side upload allowlist that accepts only expected document types (for example PDF, DOCX, XLSX, PNG, JPG) and reject executable and script extensions and double extensions, accepting that legitimate macro-enabled or legacy formats may be blocked and users may need a documented exception path; store uploaded content outside the web root or in a directory configured with script execution disabled and no execute permission, which may break inline preview or download links and require application reconfiguration; strip or neutralize executable extensions on ingest and rename files to server-generated names, which can break integrations that rely on original filenames; restrict the upload and attachment features to the smallest set of roles that need them, reducing the number of accounts that can exploit the flaw while possibly constraining normal document workflow; and deploy WAF or reverse-proxy rules that block multipart uploads containing script payloads or executable extensions, with the trade-off of possible false positives on large or unusual documents. Additionally, treat any instance that ran an affected version as potentially compromised: hunt for newly created files in upload and temp directories, review web server and application logs for unexpected script execution, and remove or quarantine suspicious artifacts. The exact upload endpoint and required role are not detailed in the advisory, so enumerate all file-submission paths during validation testing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-434 covers the class of flaws where an application accepts an uploaded file of a type that the server or a downstream interpreter will execute. In eBA Plus Document and Workflow Management System, the upload workflow that handles documents and attachments does not enforce a dangerous-type denylist or a safe-type allowlist, so a user who can reach the upload feature can store content such as a Web Shell (ASP/ASPX, PHP, JSP or similar, depending on the hosting stack). Execution becomes possible when the stored artifact lands in or is reachable from a web-accessible directory and the web server maps that extension to an interpreter; the resulting process then inherits the identity and permissions of the application pool or web user. The affected package is captured as CPE cpe:2.3:a:bimser_solution_software_trade_inc.:eba_plus_document_and_workflow_management_system:*:*:*:*:*:*:*:* (the version component is wildcarded, so the authoritative version range comes from the advisory text: 6.7.141 up to but not including 10.0.11). The CVSS vector shows PR:L, meaning the attacker first needs an authenticated low-privilege account, plus network reachability (AV:N) and no user interaction (UI:N); the advisory does not disclose the exact upload endpoint, the required role, or the storage path, so defenders must inventory every file-submission surface in the product.
Know when Eba Plus Document And Workflow Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload feature exploitable by a low-privilege authenticated user (PR:L) with no interaction; web shell yields RCE with full C/I/A impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server.
This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
Executive ViewAI
The eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) contains an authenticated file upload flaw that could allow a low-privilege user to deploy a web shell and execute code with web application privileges. Organizations running these versions face potential unauthorized server access, data compromise, and service disruption, making immediate mitigation critical for security and IT leadership. Installations on version 10.0.11 or later are not affected.
No vendor-released patch identified at time of analysis; implement interim mitigations: restrict upload functionality to trusted users, enforce strict allowlist of file extensions, store uploads outside web root, disable script execution in upload directories, deploy WAF rules to detect and block web shell uploads, monitor file system for unexpected executable files, and review self-registration settings. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Authenticated path traversal in Bimser eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not
Stored cross-site scripting (XSS) in eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not in
Exploit-DB