Vulnerability · Published Jul 13, 2026 · Assigned by DIVD

CVE-2026-22102Arbitrary file overwrite through certificate update functionality

Critical 9.3

In plain English

A critical-severity improper input validation in DC-80 from EVbee. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

Affected products (as reported)

Vendor	Product	Versions
EVbee	DC-80	0 – before 1.5.1

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://csirt.divd.nl/DIVD-2026-00001/ third-party-advisory