# CVE-2026-14946: Frauscher FDS102 unrestricted PHP file upload

Source: https://junglewise.ai/threats/cve-2026-14946-frauscher-fds102-unrestricted-php-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14946 · Severity: high · CVSS 7.2 · Published 2026-08-20

Frauscher FDS102 is a diagnostic system used in railway signaling and track management. A high-privileged attacker can upload malicious PHP files through the web interface and execute them directly, achieving complete compromise of the underlying system including access to sensitive railway infrastructure data.

Technologies: [Frauscher Sensortechnik GmbH FDS102](https://junglewise.ai/threats/technologies/fds102). Vendors: [Frauscher Sensortechnik GmbH](https://junglewise.ai/threats/vendors/frauscher-sensortechnik-gmbh).

## Quick answers

**Is CVE-2026-14946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14946 being exploited in the wild.

**How severe is CVE-2026-14946?** High severity, with a CVSS score of 7.2, published 20 August 2026.

**Which products and versions are affected?** Frauscher Sensortechnik GmbH FDS102 2.0.0 through 2.13.3.

**Is there a fix for CVE-2026-14946?** A patch was published on 2026-08-20: FDS102 v2.14.0 released as remediation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14946 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14946?** Check whether you run Frauscher Sensortechnik GmbH FDS102 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a classic unrestricted file upload (CWE-434) affecting the FDS102 web interface. A high-privileged remote attacker can bypass file type validation to upload PHP files to the /uploads/ directory and subsequently request them directly via HTTP to achieve arbitrary code execution. The root cause is improper validation of uploaded file types before storing them in a web-accessible location. Attack precondition: the attacker must have high administrative privileges on the FDS102 system. Exploitation results in full system compromise, including potential access to sensitive railway signaling and track layout information. A fix is available: update to FDS102 v2.14.0 or later.

## Affected products

- Frauscher Sensortechnik GmbH FDS102 2.0.0 through 2.13.3

## Timeline

- 2026-08-25: disclosed: CVE-2026-14946 published
- 2026-08-20: patched: FDS102 v2.14.0 released as remediation

## References

- [https://www.certvde.com/en/advisories/VDE-2026-078/](https://www.certvde.com/en/advisories/VDE-2026-078/)

## Related threats

- [Frauscher FDS102 user enumeration via API endpoint](https://junglewise.ai/threats/cve-2026-14953-frauscher-fds102-user-enumeration-via-api-endpoint)
- [Frauscher FDS102 unauthenticated file disclosure](https://junglewise.ai/threats/cve-2026-14952-frauscher-fds102-unauthenticated-file-disclosure)
- [Frauscher FDS102 Cross-Site Request Forgery in web interface](https://junglewise.ai/threats/cve-2026-14951-frauscher-fds102-cross-site-request-forgery-in-web-interface)
- [Frauscher FDS102 insufficient session expiration](https://junglewise.ai/threats/cve-2026-14950-frauscher-fds102-insufficient-session-expiration)
- [Frauscher FDS102 privilege escalation via user creation endpoint](https://junglewise.ai/threats/cve-2026-14949-frauscher-fds102-privilege-escalation-via-user-creation-endpoint)