CVE-2026-1021: Gotac Police Statistics Database System arbitrary file upload

CVE-2026-1021 · Severity: info · CVSS 9.8 · Published 2026-01-16

The Gotac Police Statistics Database System contains a critical security flaw that allows unauthorized individuals to upload malicious files to the server. This system is used for managing sensitive law enforcement data, and an exploit could allow an attacker to take full control of the server, potentially leading to data theft, service disruption, or unauthorized access to police records. Although this specific CVE identifier was later rejected by the numbering authority, the underlying technical issue was reported to affect versions up to 1.0.2.

Technologies: Gotac Police Statistics Database System. Vendors: Gotac.

Quick answers

Is CVE-2026-1021 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1021 being exploited in the wild.
How severe is CVE-2026-1021?
Informational severity, with a CVSS score of 9.8, published 16 January 2026.
Which products and versions are affected?
Gotac Police Statistics Database System up to and including 1.0.2.
Is there a fix for CVE-2026-1021?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1021 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1021?
Check whether you run Gotac Police Statistics Database System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Gotac Police Statistics Database System (versions <= 1.0.2) is vulnerable to an arbitrary file upload (CWE-434). An unauthenticated remote attacker can exploit this by uploading a malicious file, such as a web shell, to the server. Because the application fails to properly validate the type or content of uploaded files, the attacker can subsequently execute these files to achieve full remote code execution (RCE) with the privileges of the web service. While the CVE-2026-1021 ID was marked as 'Rejected' by TWCERT/CC, the initial disclosure detailed a critical impact with a CVSS 3.1 score of 9.8.

Affected products

  • Gotac Police Statistics Database System up to and including 1.0.2

Timeline

  • 2026-01-15: disclosed: Initial disclosure by TWCERT/CC
  • 2026-01-16: advisory: NVD published the CVE entry
  • 2026-07-30: other: CVE ID was rejected/withdrawn by the CNA

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.