CVE-2026-32989CWE-352CWE-434

Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload

High · published March 20, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary code execution in the context of the web server.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00312 · 22.8th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-20T15:50Z
EPSS history
Timeline
  • 20 MAR 15:50Z
    Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload
    cvelistv5