CVE-2026-2334
CriticalCVSS 9.4Summary
In vsDesk v14.0101, an authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to lack of server-side validation. This allows uploading arbitrary files, potentially leading to Remote Code Execution (RCE) within the web application context.
Risk Assessment
An attacker could gain full control over the web application, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Apply the vendor's patch (available from version 14.0402) or update vsDesk to version 14.0402 or later.
Original NVD description (English source)
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.