CVE-2026-7490 HIGH

CVE-2026-7490: Sunnet｜CTMS and CPAS - Arbitrary File Upload

Vendor Sunnet
Product CTMS
Weakness CWE-434 · Unrestricted file upload
Published May 2, 2026
Last update May 4, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Key dates

02Disclosure timeline

May 2, 2026 CVE published
May 4, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-4121 Byzoro Smart S85F Management Platform unrestricted upload CVE-2026-34027 Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files CVE-2022-3575 Frauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerability CVE-2024-32954 WordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerability CVE-2024-48027 WordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability