Vulnerability · Published Sep 3, 2026 · Assigned by INCIBE

CVE-2026-76174Multiple vulnerabilities in Ocsreports for OCS Inventory NG

Critical 9.4

In plain English

A critical-severity unrestricted file upload in Ocsreports from OCS Inventory NG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ocsinventory-server	no fix listed	DEBIAN-CVE-2026-76174
Ubuntu:22.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76174
Ubuntu:24.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76174

Affected products (as reported)

Vendor	Product	Versions
OCS Inventory NG	Ocsreports	2.12.6

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng