CVE-2026-70356
CRITICAL
NVD
CVSS Score
9.1
Severity
CRITICAL
Published
Sep 29, 2026
Vendor
unknown
Description
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.