Vulnerability · Published Jul 24, 2026 · Assigned by ZUSO ART

CVE-2026-24727SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

Critical 9.3

In plain English

A critical-severity unrestricted file upload in Corporate Training Management System from SUNNET Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.7%top 48.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

Affected products (as reported)

Vendor	Product	Versions
SUNNET Technology Co., Ltd.	Corporate Training Management System	0 – through v.10.3

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

References

https://zuso.ai/advisory third-party-advisory