mpGabinet allows an attacker who has the ability to change the database record of an attachment’s storage path to point to an arbitrary remote resource. When a user opens the modified attachment, the application retrieves that remote resource and executes it on the server, giving the attacker the ability to run arbitrary system commands. The vulnerability is a specific instance of improper validation of external resources and, according to CWE-669, permits command or file traversal that leads to remote code execution. Although the exposure requires database access, the description notes that a single chained vulnerability (CVE‑2026‑40550 or CVE‑2026‑40551) can provide this access to an otherwise unauthenticated user, thereby widening the attack surface.

The affected system is BinSoft’s mpGabinet application, specifically all releases version 23.12.19 and earlier. These releases are available from the official mpGabinet website and can be identified by their version number in the application metadata.

The CVSS score of 4.7 places this flaw in the medium severity range. EPSS data is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Nevertheless, the requirement to manipulate database entries and ingest a remote resource means the attack vector is limited to applications with write access to the attachment metadata store or to those that can obtain such access via other vulnerabilities. If an attacker can successfully chain this vulnerability with CVE‑2026‑40550 or CVE‑2026‑40551, they can achieve remote command execution and potentially compromise the entire host. The overall risk is moderate to high in environments where the mpGabinet application is exposed and database access controls are weak.