EBA Plus Document and Workflow Management System (6.7.141 - 10.0.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/eba-plus-document-and-workflow-management-system-6.7.141---10.0.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 28 Sep 2026 10:15:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnrestricted File Upload Vulnerability in eBA Plushttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-85134/Mon, 28 Sep 2026 10:15:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-85134/An unrestricted file upload vulnerability in Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System allows unauthenticated attackers to execute arbitrary code via web shell deployment.CVE-2026-85134 identifies a critical security flaw in Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System, specifically affecting versions 6.7.141 through 10.0.10. The vulnerability stems from improper validation of user-supplied files during the upload process. An unauthenticated attacker can exploit this weakness to upload executable scripts, such as web shells, directly to the web server's directory. Once the malicious file is uploaded, the attacker can trigger its execution by requesting the file path via the web server. Successful exploitation results in remote code execution (RCE) with the privileges of the web application service account. This allows for total system compromise, data exfiltration, or the establishment of persistent backdoors within the organization's environment. Defenders should prioritize patching affected instances to version 10.0.11 or later.

Impact

The vulnerability poses a high risk to organizations utilizing eBA Plus for document and workflow management. Exploitation allows unauthenticated attackers to gain remote code execution, leading to potential unauthorized access to sensitive documents, workflow metadata, and underlying server infrastructure. If exploited, an attacker could maintain persistent access to the system, modify corporate workflows, or exfiltrate intellectual property. No specific victim count is documented, but the nature of the software makes it a target for attackers seeking access to sensitive enterprise data.

Recommendation

  • Patch eBA Plus Document and Workflow Management System to version 10.0.11 or later immediately.
  • Audit web server upload directories for unauthorized script files (e.g., .aspx, .php, .jsp) created by the web application service account.
  • Restrict write permissions on the web server directory to prevent the execution of files uploaded to temporary or user-accessible paths.
  • Monitor web server logs for suspicious POST requests to document upload endpoints that result in 200 OK statuses or contain unexpected file extensions.
]]>highadvisoryvulnerabilityremote-code-executionweb-application