CVE-2026-80237
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
EFence by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, enabling arbitrary code execution on the server.
Risk Assessment
An attacker with a user account can take over the server, leading to full system and data compromise.
Recommendation
Immediately restrict file upload capabilities to trusted users only and implement file type validation and antivirus scanning.
Other vulnerabilities in EFence
See all- CVE-2026-80235Critical
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- CVE-2026-80236High
Efence by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
Original NVD description (English source)
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.