// CVE · PUBLISHED 2026-09-29
CVE-2026-70356 Toptech Systems / TMS7 · Toptech Systems / TopHAT
9.4 · CVSS 4.0 Critical
Description The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.
Details Products Toptech Systems / TMS7 · Toptech Systems / TopHAT Published 29 Sept 2026 Modified 30 Sept 2026 CVSS 9.4 Critical (v4.0) Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Score source ics-cert@hq.dhs.gov CWE CWE-434 Record status Awaiting Analysis