Description
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.
Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.

The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
Published: 2026-04-28
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

Several BinSoft applications, including mpCRM, mpFaktura, mpFirma, mpFirma ERP, mpGabinet, mpPOS, mpSekretariat, and mpWarsztat, enable execution of arbitrary system commands by a user with database write access. An attacker can upload a file attachment and then alter its database record so that the storage path points to a remote resource controlled by the attacker. When a user opens the attachment, the application fetches that remote file and executes it on the server, effectively achieving remote command execution. The flaw is a classic case of improper validation of external resources, classified as CWE‑669, and can be amplified by chaining with CVE‑2026‑40550 or CVE‑2026‑40551 to gain database access as an unauthenticated user.

Affected Systems

The affected systems are the eight BinSoft product lines listed above: mpCRM, mpFaktura, mpFirma, mpFirma ERP, mpGabinet, mpPOS, mpSekretariat, and mpWarsztat. All published releases of these products are vulnerable, regardless of version number, as the flaw stems from the shared architecture model.

Risk and Exploitability

The CVSS score of 4.7 places this flaw in the medium severity range. The EPSS score of less than 1% indicates a low likelihood that this vulnerability has been exploited at scale, and it is not listed in CISA’s KEV catalog. Still, the flaw requires database write access or a chained vulnerability to modify an attachment’s storage path. When combined with CVE‑2026‑40550 or CVE‑2026‑40551, it can provide unauthenticated access to the database and enable remote command execution, potentially compromising the entire host. The overall risk remains moderate to high, especially in environments where these BinSoft products are exposed and database access controls are relaxed.

Generated by OpenCVE AI on October 1, 2026 at 23:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all affected BinSoft products to a patched release that removes the ability to modify attachment storage paths.
  • Limit database permissions so that only trusted application processes can update attachment references; enforce application-level access controls.
  • Configure each product to reject external or remote resource references in attachment paths, implementing a strict whitelist for local files or validated URLs.
  • Apply the vendor’s corrected installation manual once issued, ensuring the product’s architecture is adjusted to prevent this exploitation path.

Generated by OpenCVE AI on October 1, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. This issue affects mpGabinet version 23.12.19 and below. Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
Title Remote Code Execution in mpGabinet Remote Code Execution in multiple BinSoft products
References

Wed, 29 Apr 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Binsoft
Binsoft mpgabinet
Vendors & Products Binsoft
Binsoft mpgabinet

Tue, 28 Apr 2026 13:45:00 +0000

Type Values Removed Values Added
Description mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. This issue affects mpGabinet version 23.12.19 and below.
Title Remote Code Execution in mpGabinet
Weaknesses CWE-669
References
Metrics cvssV4_0

{'score': 4.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H'}

Subscriptions

Binsoft Mpgabinet
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-09-30T11:18:19.667Z

Reserved: 2026-04-14T09:44:32.552Z

Link: CVE-2026-40552

cve-icon Vulnrichment

Updated: 2026-04-28T14:16:37.744Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T14:16:13.637

Modified: 2026-09-30T12:17:13.450

Link: CVE-2026-40552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T23:45:14Z

Weaknesses
  • CWE-669

    Incorrect Resource Transfer Between Spheres