Vulnerability details
CVE-2026-92532
BugTracker.NET BugTracker.NET
Unrestricted Upload of File with Dangerous Type in BugTracker.NET
CVSS 4.0
7.5High
Official description
Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server. A successful exploit could allow arbitrary code execution with the privileges of the account used by the web service.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 4.0 | CVEProject cvelistV5 (CNA) (INCIBE) | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| BugTracker.NET | BugTracker.NET | all versions | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-07
- Last updated
- 2026-10-07
- State
- Published
- Assigner (CNA)
- INCIBE
Exploit prediction (EPSS)
0.3%
Probability of exploitation in 30 days
22.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434Unrestricted upload of file with dangerous type