CVE-2026-1021 CRITICAL

CVE-2026-1021: Gotac｜Police Statistics Database System - Arbitrary File Upload

Vendor Gotac

Product Police Statistics Database System

Weakness CWE-434 · Unrestricted file upload

Published January 16, 2026

Last update January 16, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Police Statistics Database System developed by Gotac has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attacker to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Key dates

02Disclosure timeline

January 16, 2026 CVE published

January 16, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1021 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' CVE-2025-0520 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution CVE-2023-29384 WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload CVE-2023-53889 Perch CMS 3.2 Remote Code Execution via Unrestricted File Upload CVE-2026-42844 Grav: Low-privileged API users can create super-admin accounts via blueprint-upload