CVE-2026-7490

HighCVSS 7.2/10Last modified Oct 26, 2026

Description

CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Sunnet	CTMS	0
Sunnet	CPAS	0

References

https://www.twcert.org.tw/en/cp-139-10895-25ca1-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10894-1ac1f-1.htmlThird Party Advisory

Timeline

Published: May 2, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-749009.8openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simu CVE-2026-749019.8openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fal CVE-2026-749028.6SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before CVE-2026-749034.3SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CVE-2026-749047.5SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, ch CVE-2026-749057.1SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by CVE-2026-749067.5SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results usi CVE-2026-749075.9Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching inst CVE-2026-749084.6Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', a CVE-2026-749098.1Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was CVE-2026-74918.1School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a s CVE-2026-74911Software installed and run as a non-privileged user may conduct improper GPU system calls to the execution of an error path that triggers an