CVE-2026-39759: CWE-434 Unrestricted Upload of File with Dangerous Type in AmentoTech Workreap Core

This vulnerability, identified as CWE-434, exists in AmentoTech Workreap Core versions up to and including 3.4.5. It allows authenticated users with employer or sales representative roles to perform arbitrary file uploads without proper validation or restriction on file types. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.

Successful exploitation can lead to full system compromise including unauthorized disclosure of information, modification of data, and denial of service. The vulnerability affects the core functionality of the Workreap platform, potentially allowing attackers to upload malicious files that could be executed or used to escalate privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions to trusted users only and monitor for suspicious file uploads. Implement additional file validation controls if possible.