CVE-2026-40552

Remote Code Execution in multiple BinSoft products

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Description
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.
Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.

The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Analysis

AI-generated

Technical impact

Several BinSoft applications, including mpCRM, mpFaktura, mpFirma, mpFirma ERP, mpGabinet, mpPOS, mpSekretariat, and mpWarsztat, enable execution of arbitrary system commands by a user with database write access. An attacker can upload a file attachment and then alter its database record so that the storage path points to a remote resource controlled by the attacker. When a user opens the attachment, the application fetches that remote file and executes it on the server, effectively achieving remote command execution. The flaw is a classic case of improper validation of external resources, classified as CWE‑669, and can be amplified by chaining with CVE‑2026‑40550 or CVE‑2026‑40551 to gain database access as an unauthenticated user.

Affected Systems

The affected systems are the eight BinSoft product lines listed above: mpCRM, mpFaktura, mpFirma, mpFirma ERP, mpGabinet, mpPOS, mpSekretariat, and mpWarsztat. All published releases of these products are vulnerable, regardless of version number, as the flaw stems from the shared architecture model.

Risk and Exploitability

The CVSS score of 4.7 places this flaw in the medium severity range. The EPSS score of less than 1% indicates a low likelihood that this vulnerability has been exploited at scale, and it is not listed in CISA’s KEV catalog. Still, the flaw requires database write access or a chained vulnerability to modify an attachment’s storage path. When combined with CVE‑2026‑40550 or CVE‑2026‑40551, it can provide unauthenticated access to the database and enable remote command execution, potentially compromising the entire host. The overall risk remains moderate to high, especially in environments where these BinSoft products are exposed and database access controls are relaxed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all affected BinSoft products to a patched release that removes the ability to modify attachment storage paths.
  • Limit database permissions so that only trusted application processes can update attachment references; enforce application-level access controls.
  • Configure each product to reject external or remote resource references in attachment paths, implementing a strict whitelist for local files or validated URLs.
  • Apply the vendor’s corrected installation manual once issued, ensuring the product’s architecture is adjusted to prevent this exploitation path.

Generated by OpenCVE AI on October 1, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. This issue affects mpGabinet version 23.12.19 and below. Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
Title Remote Code Execution in mpGabinet Remote Code Execution in multiple BinSoft products
References
Type Values Removed Values Added
First Time appeared Binsoft
Binsoft mpgabinet
Vendors & Products Binsoft
Binsoft mpgabinet
Type Values Removed Values Added
Description mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. This issue affects mpGabinet version 23.12.19 and below.
Title Remote Code Execution in mpGabinet
Weaknesses CWE-669
References
Metrics cvssV4_0

{'score': 4.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H'}
Weaknesses
  • CWE-669

    Incorrect Resource Transfer Between Spheres

Sources

Status
PUBLISHED
Assigner
CERT-PL
Published
Updated
Sep 30, 2026, 11:18 AM
Reserved
Apr 14, 2026, 9:44 AM

View source JSON

Updated
Apr 28, 2026, 2:16 PM

JSON

Status
Deferred
Published
Apr 28, 2026, 2:16 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 1, 2026, 11:45 PM

JSON