CVE-2026-85134
Received Received - Intake

Unrestricted File Upload in Bimser eBA Plus

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-85134
EUVD
EUVD-2026-88171

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bimser_solution_software_trade_inc eba_plus_document_and_workflow_management_system From 6.7.141 (inc) to 10.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to upload a malicious file, such as a web shell, to a web server running the Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System. The system fails to properly restrict file types, enabling the execution of harmful code.

Detection Guidance

To detect this vulnerability, inspect uploaded files on the eBA Plus system for unexpected file types like .jsp, .php, or .aspx in directories accessible via web servers. Check for unusual file uploads in the system's document storage paths. Monitor network traffic for signs of web shell activity such as unexpected HTTP requests or command execution patterns.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system, steal sensitive data, or perform further attacks. Systems running affected versions (6.7.141 to before 10.0.11) are at risk of compromise.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Update eBA Plus Document and Workflow Management System to version 10.0.11 or later to address the unrestricted file upload vulnerability. Ensure proper access controls are in place to prevent unauthorized file uploads and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart