{"id":"CVE-2026-5695","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-5695","generatedAt":"2026-10-28T03:32:13.676Z","title":"Arbitrary file upload vulnerability due to a lack of proper validation in upload forms.","description":"Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.","published":"2026-09-23T11:17:11.000Z","lastModified":"2026-09-24T14:45:23.000Z","status":"Deferred","sourceIdentifier":"cve-coordination@incibe.es","cvss":{"version":"4.0","score":8.4,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-434"],"affected":[],"epss":{"score":0.00409,"percentile":0.35017,"date":"2026-10-27","history":[{"date":"2026-09-24","score":0.00298,"percentile":0.19978}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-23T11:17:11.000Z","detail":{"score":"8.4","severity":"HIGH","publishedAt":"2026-09-23T11:17:10.590Z"},"summary":"New CVE, high severity (CVSS 8.4)."}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel","source":"cve-coordination@incibe.es"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-5695","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}