EUVD Vulnerability Catalog

EUVD-2026-110807

Severity: HIGH Base Score: 8.8 CVSS Version: 4.0

Vulnerability Description

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Vulnerability Confidentiality Impact (VC): Low

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): High

▪ Subsequent Confidentiality Impact (SC): Low

▪ Subsequent Integrity Impact (SI): Low

▪ Subsequent Availability Impact (SA): Low

Affected Vendors & Systems

Vendor PuMuKIT

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-pumukit-application

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

Known Aliases

CVE-2026-4337

Published On

2026-10-27

Last Updated

2026-10-27