Quick answers
- Is CVE-2026-76174 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76174 being exploited in the wild.
- How severe is CVE-2026-76174?
- Informational severity, with a CVSS score of 7.2, published 3 September 2026.
- Which products and versions are affected?
- Ocsreports Ocsreports.
- Is there a fix for CVE-2026-76174?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76174 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-76174?
- Check whether you run Ocsreports. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an unrestricted file upload flaw in the admin_info endpoint's CSV upload functionality. The application performs insufficient validation, checking only the filename provided by the client rather than verifying the actual file content or enforcing a whitelist of permitted types. An attacker with administrator privileges can upload PHP files or other executable scripts to a web-accessible directory. If the server subsequently processes or executes these files, the attacker achieves remote code execution with the privileges of the web service account. The attack requires valid admin credentials but can lead to full system compromise.
Affected products
- Ocsreports Ocsreports
Timeline
- 2026-09-03: disclosed