Vulnerability · Published Oct 7, 2026 · Assigned by INCIBE
CVE-2026-92532Unrestricted Upload of File with Dangerous Type in BugTracker.NET
High 7.5
In plain English
A high-severity unrestricted file upload in BugTracker.NET from BugTracker.NET. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server. A successful exploit could allow arbitrary code execution with the privileges of the account used by the web service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BugTracker.NET | BugTracker.NET | all versions |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N