Attack Chain

1. The attacker identifies a Borg SPM 2007 server exposed to the internet.
2. The attacker sends a crafted HTTP POST request to the server, exploiting the file upload vulnerability (CVE-2026-6885).
3. The POST request contains a malicious file, such as a PHP web shell, disguised with a permissible extension or without any extension check.
4. The Borg SPM 2007 server saves the uploaded file to a publicly accessible directory, without proper sanitization.
5. The attacker sends another HTTP request to access the uploaded web shell.
6. The web server executes the web shell code, granting the attacker arbitrary code execution on the server.
7. The attacker uses the web shell to gain a persistent foothold, install malware, or exfiltrate sensitive data.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the vulnerable server. This can lead to full system compromise, data theft, and potential disruption of services. While the number of active installations is likely low due to the product’s end-of-life status in 2008, organizations still running Borg SPM 2007 are at high risk if the system is exposed to the Internet.

Recommendation

• Identify instances of Borg SPM 2007 running in your environment and isolate them from the network if possible.
• Implement the provided Sigma rule to detect potential web shell uploads based on HTTP request characteristics.
• Since no patch exists, consider immediate decommissioning or migration to a supported alternative.