CVE-2026-34027CWE-434

Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files

Medium · published June 15, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-06-15T10:04Z
EPSS history
Timeline
  • 15 JUN 10:04Z
    Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files
    cvelistv5