Description

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T18:17:08.760Z",
  "pubdate": "2026-08-17T18:17:08.760Z",
  "executiveSummary": "A file upload vulnerability has been identified in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1, specifically residing within the add attachments feature of the create new document function.\nThis security flaw enables a remote attacker to execute arbitrary code on the underlying server, posing severe risks to system integrity, confidentiality, and availability.\nThe vulnerability allows remote execution capabilities without prior authentication or privilege escalation requirements, depending on the exposure of the affected endpoint.\nSuccessful exploitation compromises the entire host system, potentially allowing the threat actor to deploy web shells, pivot through the internal network, exfiltrate sensitive document repositories, or disrupt core business operations.\nThe root cause stems from improper validation and sanitization of user-supplied files uploaded through the document creation workflow.",
  "technicalDetails": "The vulnerability is classified as an Unrestricted File Upload flaw occurring within the document management and attachment processing logic of T-Systems International GmbH ImageMaster Version: 9.14.2.8.1.\nThe vulnerable component is the create new document function, specifically the subsystem responsible for handling the add attachments feature.\nAttack vectors involve a remote attacker interacting with the document creation interface to upload malicious files, such as executable scripts or web shells, disguised as legitimate document attachments.\nThe root cause of the vulnerability is the absence of rigorous server-side validation mechanisms for file extensions, content types, and magic byte verification.\nDue to the lack of input sanitization, the application fails to restrict the types of files that can be uploaded or fails to store uploaded files in a non-executable directory with disabled script execution permissions.\nThe attack flow proceeds as follows: First, the remote attacker accesses the create new document function within the application interface. Second, the attacker utilizes the add attachments feature to upload a crafted payload file containing arbitrary executable code. Third, the application processes and stores the uploaded file on the server filesystem, often within a web-accessible directory. Finally, the attacker triggers the execution of the uploaded payload by sending a direct HTTP request to the stored file path, resulting in arbitrary code execution within the security context of the web application server process.\nNetwork exposure for this vulnerability is remote, allowing exploitation over network boundaries if the document creation interface is accessible to the attacker.\nPost-exploitation impact includes full system compromise, remote code execution, unauthorized access to stored documents and metadata, and potential lateral movement within the network infrastructure hosting the ImageMaster deployment."
}