CVE-2026-24727 CRITICAL

CVE-2026-24727: SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

Vendor Sunnet Technology Co., Ltd.
Product Corporate Training Management System
Weakness CWE-434 · Unrestricted file upload
Published July 24, 2026
Last update July 24, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

What the vulnerability does

01Description

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

Key dates

02Disclosure timeline

July 24, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-32482 WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload CVE-2026-27043 WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability CVE-2026-6692 Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url CVE-2025-13067 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass