CVE-2026-32989 — Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload

CVE-2026-32989

Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload PUBLISHED

Description (CNA)

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary code execution in the context of the web server.

Affected (CNA)

Vendor / product	Versions
Precurio / Precurio Intranet Portal	affected 4.4

CWE

CWE-352, CWE-434

References

https://www.packetstorm.news/files/id/215644/
https://www.precurio.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.