CVE-2026-76174 in Ocsreports
Summary
by MITRE • 09/03/2026
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in the Ocsreports admin_info endpoint represents a critical failure in input validation and access control mechanisms within the application's CSV file upload functionality. This specific flaw is categorized under CWE-434, which describes an unrestricted upload of files with dangerous types, allowing attackers to introduce malicious content into systems that are intended for legitimate data processing. The core technical deficiency lies in the server-side logic responsible for handling incoming uploads from authenticated administrators. Instead of performing a robust verification process that includes checking file signatures, MIME type analysis, or validating against a strict allowlist of permitted extensions based on actual content rather than just client-supplied metadata, the application relies exclusively on the filename provided by the user agent. This approach is fundamentally insecure because filenames can be trivially spoofed to bypass superficial checks, leaving the system vulnerable to arbitrary file upload attacks where an attacker can dictate the nature and execution context of the uploaded data.
From a tactical perspective, this vulnerability aligns with MITRE ATT&CK technique T1505.003, known as Web Shell: ASPX, or more broadly T1505.002 for PHP web shells, depending on the specific server environment. By exploiting this flaw, an attacker who has obtained administrator privileges can upload a malicious PHP script disguised as a CSV file to a directory that is directly accessible via the HTTP protocol. Once uploaded, if the web server interprets files in that location with its scripting engine, the uploaded code will execute automatically upon access or potentially through other automated processes within the application. This effectively grants the attacker full remote code execution capabilities on the underlying operating system, constrained only by the privileges of the account running the web service process. The impact is severe as it allows for complete compromise of the server hosting Ocsreports, leading to potential data exfiltration, lateral movement across the network, and persistent backdoor access that can be difficult to detect without specialized monitoring tools.
The operational impact extends beyond immediate code execution to include significant risks to system integrity and availability. An attacker leveraging this vulnerability could modify existing configuration files, inject additional malicious scripts, or use the compromised server as a pivot point for further attacks against internal assets. Since Ocsreports is often used in enterprise environments for IT asset management, compromising its infrastructure may expose sensitive inventory data, user credentials stored within the database, and network topology information to unauthorized parties. Furthermore, because the vulnerability requires administrator-level access initially, it highlights a broader issue with privilege escalation or credential theft; however, even if an attacker starts with lower privileges, this flaw provides a direct path to elevate their status to full system control by exploiting the trusted administrative interface.
To mitigate this risk, immediate remediation steps must focus on implementing strict file validation controls at multiple layers of the application stack. Developers should enforce server-side validation that inspects the actual content and structure of uploaded files rather than relying solely on extensions or filenames. Implementing a robust allowlist for permitted file types is essential, ensuring that only genuine CSV structures are accepted by the parser. Additionally, uploaded files should be stored in directories outside of the web root to prevent direct execution via HTTP requests, or if storage within the web directory is necessary, execute permissions must be explicitly disabled on those folders using server configuration directives such as Apache's Options directive or Nginx location blocks. It is also critical to review and harden authentication mechanisms for administrative endpoints to ensure that only verified, authorized personnel can access upload functionalities, thereby reducing the attack surface available to potential adversaries seeking to exploit this pathway for remote code execution.