CVE-2026-80237CWE-434unrestricted-file-upload

CVE-2026-80237

High · published August 26, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
55.7
In the wild
Unconfirmed
What it is

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00786 · 55.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-26T13:16Z
References (2)
https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html · [email protected]
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 1%
    epss
  • 26 AUG 08:28Z
    Thinking Software Technology｜Efence - Arbitrary File Upload
    cvelistv5