EUVD-2026-89469
GHSA-63hp-3v6g-vpmq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable upload endpoint (AV:N/AC:L) but requires high-privilege authentication (PR:H); code execution confined to the web server keeps scope unchanged (S:U) with full C/I/A impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Articles & Coverage 1
AnalysisAI
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS file upload endpoint performs no server-side file type validation, letting a PHP payload be written to the web server and then executed. The flaw is network-reachable and requires no user interaction, but the CVSS vector (PR:H) and the independent assessment confirm it is only exploitable by a remote attacker who already holds high-privilege authenticated access to the TMS7/TopHat web application - a default configuration without valid credentials is not vulnerable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker with high-privilege authenticated access (PR:H) to the TMS7/TopHat web application's file upload endpoint; that endpoint enforces no server-side file-type restriction, allowing a PHP payload to be uploaded and then executed by the web server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine remote code execution flaw (CWE-434 unrestricted file upload leading to arbitrary PHP execution) whose severity is tempered by an authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released fix: upgrade TMS7 and TopHat to version 7.8, which the vendor's security blog (https://www.toptech.com/blog/tms7-version-7-8-strengthens-security) documents as containing the security strengthening for this issue, and refer to CISA ICS-CERT advisory ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02) for the official guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Toptech Systems TMS7/TopHat 7.6.3 instances are internet-facing or reachable from untrusted networks and restrict network access to them; inventory and review all high-privilege accounts on those systems, enforce MFA where supported, rotate credentials, and enable detailed logging on the TMS file upload endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today