CVE-2026-86272

Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Analysis

AI-generated

Technical impact

A flaw in the /Report/Upload/UploadFormImg.ashx handler of Beijing Meite Software Technology’s U+Smart Enjoyment WebSite permits an attacker to manipulate the File argument and upload files without any restrictions. This vulnerability can be exploited remotely, enabling the delivery of arbitrary files, including executable code, which may lead to further compromise of the host system. The weakness maps to access‑control and unrestricted upload defects identified by CWE-284 and CWE-434, respectively.

Affected Systems

Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000 is known to contain the flaw; no other affected versions are listed in the current data.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity level. EPSS data is unavailable, and the vulnerability does not appear in the CISA KEV catalog. Because the attack can be launched from a remote source via the publicly exposed upload endpoint, the likelihood of exploitation depends on the site’s exposure and any existing countermeasures. The risk remains moderate until a vendor update is applied or mitigation controls are implemented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Implement server‑side validation that restricts uploads to approved file types and extensions, rejecting or quarantining all other uploads.
  • Restrict access to the /Report/Upload/UploadFormImg.ashx endpoint using firewall rules, IP whitelisting, or authentication so that only authorized administrators can reach it.
  • Monitor file upload activity and log incidents to detect potential abuse of the unrestricted upload endpoint.

Generated by OpenCVE AI on September 7, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload
First Time appeared Beijing Meite Software Technology
Beijing Meite Software Technology u Smart Enjoyment Website
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:beijing_meite_software_technology:u_smart_enjoyment_website:*:*:*:*:*:*:*:*
Vendors & Products Beijing Meite Software Technology
Beijing Meite Software Technology u Smart Enjoyment Website
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 1:43 PM
Reserved
Sep 6, 2026, 12:51 PM

View source JSON

Updated
Sep 8, 2026, 1:42 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 5:16 AM
Modified
Sep 8, 2026, 2:17 PM

View source JSON

No data.

Updated
Sep 7, 2026, 8:24 AM

JSON