CVE-2026-76174: CWE-434 Unrestricted upload of file with dangerous type in OCS Inventory NG Ocsreports

This vulnerability (CWE-434) affects Ocsreports component of OCS Inventory NG version 2.12.6. It arises because the CSV file upload functionality does not properly validate or restrict the types of files uploaded, relying solely on the filename provided by the client. An attacker with administrator privileges can upload malicious PHP files to a directory accessible via the web interface. If the server processes these files, it could lead to arbitrary code execution under the web service account. The CVSS 4.0 base score is 9.4, indicating critical severity. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrator privileges to upload and execute arbitrary PHP code on the server, potentially leading to full compromise of the web service environment. This can result in unauthorized control over the server, data exposure, or further lateral movement within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or restricting the CSV upload functionality. Monitor for suspicious file uploads and web server activity related to uploaded files. Avoid exposing the upload directory to direct web access if possible.