CVE-2026-11839

CriticalCVSS 9.9/10Last modified Oct 26, 2026

Description

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server.

This issue affects Rotaban: from V2026.06.002 before V2026.06.003.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Başarsoft Information Technologies Inc.	Rotaban	>= V2026.06.002, < V2026.06.003

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0367

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1183918.9Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust CVE-2026-1183944.3The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the CVE-2026-1183957.5Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/CVE-2026-11847.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 t CVE-2026-118408.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticate CVE-2026-1184033.7The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allo CVE-2026-1184045.3The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping ca CVE-2026-1184054.3Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users CVE-2026-1184075.4The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any a CVE-2026-1184083.1Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role CVE-2026-1184095.3Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover t CVE-2026-118419.4An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due t