CVE-2026-2334
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In vsDesk v14.0101, an authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to lack of server-side validation. This allows uploading arbitrary files, potentially leading to Remote Code Execution (RCE) within the web application context.
Risk Assessment
An attacker could gain full control over the web application, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Apply the vendor's patch (available from version 14.0402) or update vsDesk to version 14.0402 or later.
Other vulnerabilities in vsDesk
See all- CVE-2025-14600Critical
vsDesk contains an insecure deserialization vulnerability that allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.
- CVE-2025-14601High
An OS command injection vulnerability in vsDesk allows an authenticated attacker with admin privileges to execute arbitrary OS commands due to insufficient input filtering.
- CVE-2025-14602Medium
The application generates uploaded file names using a weak and predictable method based on the request timestamp. A remote attacker can guess or brute-force the filename within a short time window, access uploaded files, and facilitate further attacks.
- CVE-2025-14603High
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/. Versions 14.0101 and on have the patch.
Original NVD description (English source)
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS