Executive brief
A software repository management system used to store and distribute code and software artifacts contains a vulnerability that allows attackers to upload malicious files without proper validation. An attacker can upload and execute a web shell on the server, gaining complete control over the system and potentially exposing all stored code, credentials, and other sensitive data hosted on the repository.
Technical details
The vulnerability is an unrestricted file upload flaw in TRtek's Software Repository Management platform that fails to properly validate file types during the upload process. An attacker with network access to the upload functionality can bypass file type restrictions and upload executable files (such as web shells) directly to the web server. This allows arbitrary code execution on the server, leading to complete system compromise. The vulnerability affects versions before commit 2fb4acee and has a CVSS score of 9.8, indicating critical severity. A patch is available in commit 2fb4acee or later.
Affected products
- TRtek Software Repository Management before 2fb4acee
Timeline
- 2026-08-25: published