BugTracker.NET EUVD-2026-94284

Exploitation requires an authenticated BugTracker.NET administrator (PR:H) who first modifies the application configuration so that uploaded attachments are stored in a directory served by the web server - a non-default change. The attacker then abuses the attachment feature's missing file-extension validation to upload an executable .aspx file and requests its URL to trigger server-side execution as the web service account. Limiting factors: administrator-level access is mandatory, the web-accessible attachment storage configuration is not the default (reflected as AT:P in the CVSS 4.0 vector), and the server must process .aspx (ASP.NET/IIS); no victim user interaction is required (UI:N).

This is a genuine but conditional remote code execution flaw (CWE-434 unrestricted file upload) that the signals consistently describe as LOW real-world priority despite the HIGH CVSS 4.0 base score of 7.5. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H) confirms three strong limiting factors: PR:H means the attacker must already hold administrator privileges, and AT:P indicates a precondition outside the attacker's control (the admin must first reconfigure the application to store attachments in a web-accessible directory). In other words, an attacker who can trigger this already controls the application's administrative plane, sharply reducing the marginal risk. There is NO EPSS score, NO CISA KEV listing, and NO public exploit referenced in the provided data, so exploitation is 'no public exploit identified at time of analysis.' The subsequent-system impact is explicitly N (SC:N/SI:N/SA:N), meaning impact is contained to the host web service account rather than cascading. Net assessment: a legitimate post-authentication RCE worth patching, but not an emergency - the high score is driven by full CIA impact, while the practical likelihood is throttled by the admin-privilege and non-default-configuration requirements. Missing data to flag: no EPSS, no KEV, no POC, and no vendor-confirmed fixed version in the provided references.

An attacker who has obtained (or abused) BugTracker.NET administrator credentials reconfigures the attachment storage path to point to a web-accessible directory, then uploads a malicious .aspx file through the attachment feature, which lacks file-extension validation. The attacker then browses to the uploaded file's URL, causing the web server to execute it and granting arbitrary code execution under the web service account. No public proof-of-concept is referenced, and the attack requires high privileges plus a non-default configuration change, so it is a post-authentication scenario rather than a drive-by.