CVE-2026-40552 in BinSoft's mpGabinet (version 23.12.19 and below) is an incorrect resource transfer vulnerability (CWE-669) that leads to remote command execution. An authorized user with backend database access can upload an attachment and alter its storage path in the database to reference an attacker-controlled remote network resource. When the application processes and opens this attachment, the referenced resource is executed by the system. Furthermore, this vulnerability can be exploited by unauthenticated attackers by chaining with CVE-2026-40550 and CVE-2026-40551, which enable database access and account login, thus expanding the attack surface significantly. The vulnerability has a CVSS 4.7 score, reflecting medium severity, and no official fix or patch has been published as of the data provided.

Successful exploitation allows remote command execution on the system running mpGabinet, potentially leading to system compromise. The vulnerability requires database access for direct exploitation but can be leveraged by unauthenticated attackers when combined with related vulnerabilities that provide database and account access. This increases the risk of unauthorized system control and data compromise. The medium CVSS score reflects the moderate complexity and required privileges for exploitation, but the chaining with other vulnerabilities raises the overall threat level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend database access to trusted users only and monitor for any unusual attachment modifications. Consider disabling attachment processing features if feasible to reduce risk. Since no official patch or temporary fix is currently available, closely follow vendor communications for updates.