CVE-2026-5695CWE-434unrestricted-file-upload

CVE-2026-5695

published September 23, 2026

CVSS
8.4
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-23T15:17Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel · [email protected]
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 23 SEP 10:20Z
    Multiple vulnerabilities in the Microweber administration panel
    cvelistv5