CVE-2026-24727 — SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

CVE-2026-24727

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type PUBLISHED

Description (CNA)

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

Affected (CNA)

Vendor / product	Versions
SUNNET Technology Co., Ltd. / Corporate Training Management System	affected 0 through v.10.3

CWE

CWE-434

References

https://zuso.ai/advisory

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.