CVE-2026-19852: CWE-434 Unrestricted Upload of File with Dangerous Type in CyberTutor NewSiteServer (NSS)

CVE-2026-19852 describes an unrestricted file upload vulnerability in CyberTutor's NewSiteServer (NSS). The flaw allows unauthenticated remote attackers to upload arbitrary files, including potentially malicious HTML files, which can be used to execute attacks similar to cross-site scripting. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact.

Successful exploitation could allow attackers to upload malicious files that may execute in the context of the web application, potentially leading to partial confidentiality and integrity compromise similar to cross-site scripting effects. There is no indication of availability impact. The vulnerability does not require authentication, increasing its risk profile.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload functionality, implement strict server-side validation of uploaded file types, and consider disabling file uploads if not necessary.