Vulnerability details
CVE-2026-70356
Toptech Systems TMS7Toptech Systems TopHAT
Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
CVSS 4.0
9.4Critical
Official description
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (icscert) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (icscert) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Toptech Systems | TMS7 | 7.6.3 | CVEProject cvelistV5 (CNA) |
| Toptech Systems | TopHAT | 7.6.3 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-30
- Last updated
- 2026-09-30
- State
- Published
- Assigner (CNA)
- icscert
Exploit prediction (EPSS)
0.41%
Probability of exploitation in 30 days
36.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434