CVE-2026-86272
Received Received - Intake

Unrestricted File Upload in U+Smart Enjoyment WebSite

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86272
EUVD
EUVD-2026-72254

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
beijing_meite_software_technology u_smart_enjoyment_website 18.6001.1096.1000

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000. It involves an unrestricted file upload vulnerability in the /Report/Upload/UploadFormImg.ashx component. Attackers can manipulate the File argument to upload malicious files remotely without proper restrictions.

Detection Guidance

Detecting this vulnerability requires checking for unrestricted file upload functionality in the /Report/Upload/UploadFormImg.ashx endpoint. Monitor network traffic for unusual file uploads to this path. Inspect web server logs for POST requests to this endpoint with file attachments.

Impact Analysis

This vulnerability allows remote attackers to upload arbitrary files to the server. This could lead to remote code execution, malware distribution, or unauthorized access to sensitive data. Systems hosting this software may be compromised if exploited.

Mitigation Strategies

Immediately restrict file uploads to the /Report/Upload/UploadFormImg.ashx endpoint. Implement strict file type validation and size limits. Disable execution permissions for uploaded files. Update or patch the U+Smart Enjoyment WebSite to the latest version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart