CVE-2026-22102
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
Risk Assessment
An attacker can cause a denial of service (DoS) by overwriting critical system files or achieve remote code execution (RCE) by overwriting shell scripts whose execution can be triggered through other means.
Recommendation
Immediately update the web server to a version containing a fix for this vulnerability. Until the update is applied, restrict access to the vulnerable endpoint and implement validation of the filename parameter in the Content-Disposition header.
Original NVD description (English source)
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.