CRITICALCVSS v3.1 9.8Vulnerability
CVE-2026-82504
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- CRITICAL
- Cvss score
- 9.8
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 9.8
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-82504
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-14T00:50:05+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-13T21:17:48.030
- Last modified
- 2026-11-13T21:17:48.030
Related Entities (2)
HAS_WEAKNESS (2)
Related research
Explore deeper with Ninja Signal's threat intelligence graph