Skip to content
Heist/ feed
Medium

Remote Code Execution in multiple BinSoft products

Type: advisorySource: Official CVE List1 source record

Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Announced Source revision 1
Original source ↗

CVE-2026-40552

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-40552

mpGabinet

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFaktura

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma ERP

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpSekretariat

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpPOS

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpCRM

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpWarsztat

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "BinSoft",
    "product": "mpGabinet",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "23.12.19"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFaktura",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma ERP",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpSekretariat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpPOS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpCRM",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpWarsztat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "20.4.28"
      }
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-40552

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#4181 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement