{"id":"CVE-2026-92532","published":"2026-10-07T11:17:20.287","lastModified":"2026-10-07T18:17:31.510","description":"Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server. A successful exploit could allow arbitrary code execution with the privileges of the account used by the web service.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bugtrackernet","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}