Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92532— Unrestricted Upload of File with Dangerous Type in BugTracker.NET

Quick assessment

Affected
BugTracker.NET BugTracker.NET
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BugTracker.NET 的附件功能存在未受限制的文件上传漏洞。具有管理员权限的经过身份验证的用户可以修改应用程序配置，将文件存储到可通过 Web 接口访问的目录中。由于缺乏对文件扩展名的适当验证，攻击者可以上传恶意的 ASPX 文件，并在服务器上执行该文件。成功利用此漏洞将允许攻击者以 Web 服务所使用的账户权限执行任意代码。

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92532

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unrestricted Upload of File with Dangerous Type in BugTracker.NET
Source: CVE Program / CVE List V5
Vulnerability Description
Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server. A successful exploit could allow arbitrary code execution with the privileges of the account used by the web service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BugTracker.NET BugTracker.NET all versions -

II. Public POCs for CVE-2026-92532

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92532

请登录查看更多情报信息。

Other References for CVE-2026-92532 (1)

Same Patch Batch · BugTracker.NET · 2026-10-07 · 3 CVEs total

CVE-2026-92531 7.5 HIGH Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET
CVE-2026-92533 7.1 HIGH Path Traversal in BugTracker.NET

IV. Related Vulnerabilities

Same product: BugTracker.NET
Same vendor: BugTracker.NET
Same weakness: CWE-434

V. Comments for CVE-2026-92532

No comments yet

Leave a comment