CVE-2026-2334

Published: Ago 20, 2026 Last Modified: Ago 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the 'Import via CSV' component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. 
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.

434

Unrestricted Upload of File with Dangerous Type

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: ASP.NET, PHP, Not Language-Specific
Technologies: Web Server, AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://github.com/klsecservices/Advisories/blob/master/KLS…
https://github.com/klsecservices/Advisories/blob/master/KLSA-00415-Missing-Serv…
https://vsdesk.ru/news/vyshla-novaya-versiya-140422
https://vsdesk.ru/news/vyshla-novaya-versiya-140422