CVE-2026-51924 describes a vulnerability in docuForm GmbH Client v11.11c where an attacker with low privileges can remotely execute arbitrary code by exploiting the file upload functionality combined with the report.php component. The vulnerability is categorized under CWE-639, indicating improper authorization or access control issues. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with network attack vector, low attack complexity, and no user interaction required. No known exploits in the wild or vendor advisories specifying remediation are currently available.

Successful exploitation allows remote code execution by an attacker with limited privileges, potentially compromising the confidentiality and integrity of the affected system. Availability impact is not indicated. The vulnerability can be triggered remotely without user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected components and monitor for suspicious activity related to file uploads and report.php usage. Avoid exposing the vulnerable service to untrusted networks if possible.