CVE-2026-42099
Race Condition in Sparx Pro Cloud Server Leads to RCE
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sparxsystems | sparx_pro_cloud_server | to 6.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Sparx Pro Cloud Server is a race condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads an object based on a guid parameter and saves its content as a file in the current directory. An attacker with repository access can control both the filename and the file contents, allowing them to create a malicious PHP file in that directory.
Although the malicious file is deleted after processing, if the response transmission is delayed (for example, due to a large file or slow client connection), the file remains accessible temporarily. During this window, the attacker can send a second request to execute the malicious PHP file, leading to remote code execution on the server.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with repository access to execute arbitrary code remotely on the affected server. This means the attacker could potentially take control of the server, access sensitive data, modify or delete files, disrupt services, or use the server as a foothold to attack other systems.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability affects Sparx Pro Cloud Server version 6.1 (build 167) and below. Immediate mitigation steps include restricting repository access to trusted users only, as an attacker needs repository access to exploit the vulnerability.
Additionally, monitoring and limiting slow client connections or large file downloads to reduce the window of the race condition may help mitigate exploitation.
Since the vendor has not provided patches or detailed version information, consider upgrading to a version above 6.1 if available and confirmed safe, or applying network-level protections to limit access to the vulnerable endpoint.