DEBIAN-CVE-2026-76174
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.
DEBIAN-CVE-2026-76174
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-76174
ocsinventory-server
Source reference: /affected/0/package/name
- Affected versions
- 2.8.1+dfsg1+~2.11.1-1
Source reference:
/affected/0/versions2.8.1+dfsg1+~2.11.1-2Source reference:
/affected/0/versions2.8.1+dfsg1+~2.11.1-3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ocsinventory-server",
"purl": "pkg:deb/debian/ocsinventory-server?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.8.1+dfsg1+~2.11.1-1",
"2.8.1+dfsg1+~2.11.1-2",
"2.8.1+dfsg1+~2.11.1-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-76174.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58327 · Revision 1
- Added to Heist Feed
- Publisher date