CVE-2026-24727
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.
Risk Assessment
Administrators can be tricked into uploading a malicious file, leading to remote code execution on the server and full compromise of the training management system.
Recommendation
Upgrade SUNNET Corporate Training Management System to a version later than v10.3 and implement file type validation and archive scanning mechanisms.
Original NVD description (English source)
An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.