CVE-2026-39757: CWE-434 Unrestricted Upload of File with Dangerous Type in AmentoTech Taskbot

This vulnerability (CWE-434) in AmentoTech Taskbot versions up to 6.6 permits authenticated subscribers to upload files of any type without proper validation or restriction. Such arbitrary file upload flaws can enable attackers to execute malicious code, overwrite critical files, or disrupt service. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges of a subscriber, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with subscriber-level privileges to upload dangerous files, potentially leading to full system compromise including data theft, unauthorized code execution, and denial of service.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict subscriber file upload permissions where possible and monitor for suspicious file uploads.