Below is the list of key information about vulnerability `MNDT-2026-0003` obtained through analysis of the webpage content: - **Vulnerability Description**: In versions of `Explorance Blue` prior to `8.14.9`, there exists an unrestricted file upload vulnerability in the management interface after authentication. Due to insufficient file type restrictions, attackers can upload and execute malicious files. This leads to remote code execution under default configurations. - **Impact**: Authenticated attackers can upload files with controllable filenames and extensions, resulting in arbitrary file writes on the server, which can lead to remote code execution. - **Exploit Difficulty**: Medium. Exploiting this vulnerability requires authenticated access, sufficient privileges, and the ability to craft malicious payloads. - **CVE ID**: `CVE-2025-57794` - **Common Weakness Enumeration**: `CWE-434: Unrestricted Upload of File with Dangerous Type` - **Vulnerability Details**: The vulnerability stems from inadequate enforcement of file upload restrictions. Although some validation checks exist, they are insufficient to prevent specially crafted malicious file uploads. Attackers with administrative privileges can exploit this to place executable code on the server, leading to full remote code execution. - **CVSS Score**: `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` - **Remediation**: The issue has been fixed in `Explorance Blue` version `8.14.9`. - **Discovery Contributor**: `Abdulrahman Nour` from `Mandiant` - **Disclosure Timeline**: - April 28, 2025: Initial report submitted to `Explorance` - May 2, 2025: Initial patch released - May 6, 2025: Final patch released to customers - **Reference Links**: - [Explorance Blue Official Website](exploarance link) - [CVE.org - CVE-2025-57794](CVE link) - [Explorance Blue Security Notice, January 2026](security notice January 2026 link) - [Explorance Blue Security Notice, CVE-2025-57794](specific CVE notice link)