CVE-2026-5261
Published: 01 April 2026
Summary
CVE-2026-5261 is a medium-severity Improper Access Control (CWE-284) vulnerability in Feishu (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-5261 is an unrestricted file upload vulnerability in Shandong Hoteam InforCenter PLM versions up to 8.3.8. The flaw affects the uploadFileToIIS function in the /Base/BaseHandler.ashx file, where manipulation of the File argument enables attackers to upload arbitrary files. It is associated with CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), earning a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is exploitable remotely by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants limited impacts on confidentiality, integrity, and availability, potentially allowing attackers to upload malicious files that could lead to further compromise depending on server configuration.
No vendor response or patches are available, as the supplier was contacted early but did not reply. Advisory references from VulDB detail the issue and note that a public exploit exists, which might be leveraged in attacks.
The exploit is publicly available, increasing the risk of real-world usage against exposed instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17849
Vulnerability details
A vulnerability was identified in Shandong Hoteam InforCenter PLM up to 8.3.8. The impacted element is the function uploadFileToIIS of the file /Base/BaseHandler.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack…
more
remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing application directly enables remote exploitation (T1190) and web shell deployment (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates unrestricted file upload by requiring validation of the manipulated File argument to reject dangerous or arbitrary files.
Enforces access control policies to block unauthenticated remote manipulation of the uploadFileToIIS function.
Scans uploaded files for malicious code at entry points, preventing execution of dangerous types exploited via this vulnerability.