CVE-2026-40552
Remote Command Execution in mpGabinet via Attachment Path Manipulation
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mpgabinet | mpgabinet | to 23.12.19 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-669 | The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in mpGabinet allows remote command execution by an authorized user with database access, and can be exploited by unauthenticated attackers through chaining with other vulnerabilities to gain database access and account login.
Such unauthorized access and execution could lead to unauthorized data exposure, modification, or system compromise, which may violate data protection requirements under standards like GDPR and HIPAA.
Therefore, this vulnerability potentially impacts compliance by increasing the risk of data breaches and unauthorized access to sensitive information.
Can you explain this vulnerability to me?
mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can execute system commands by uploading an attachment and then modifying its storage path in the database to point to an attacker-controlled remote network resource. Alternatively, an attacker can use a previously uploaded file and change its reference. When the application processes the attachment and a user tries to open it, the referenced resource is executed by the system.
Moreover, this vulnerability can be exploited by any unauthenticated attacker by chaining it with two other vulnerabilities (CVE-2026-40550 and CVE-2026-40551) that allow obtaining database access and logging onto any account.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary system commands on the server hosting the mpGabinet application. This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential further exploitation of the affected environment.
Since an unauthenticated attacker can chain this vulnerability with others to gain database access and log into any account, the impact includes loss of confidentiality, integrity, and availability of the system and its data.