Description

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-12T16:17:13.927Z",
  "pubdate": "2026-08-12T16:17:13.927Z",
  "executiveSummary": "A privileged arbitrary file write vulnerability has been identified in WhatsUp Gold versions released before 2026.0.2.\nThis security flaw enables an authenticated attacker with administrative or high-level privileges to write arbitrary files directly to web-accessible directories on the underlying host server.\nThe primary impact of this vulnerability includes potential remote code execution, system compromise, and unauthorized modification of critical web application resources.\nThe affected product is WhatsUp Gold for all versions prior to 2026.0.2.\nThe risk implications are severe due to the capability of placing malicious payloads within web root directories, which can subsequently be executed or leveraged to compromise the hosting infrastructure.\nExploitation of this vulnerability requires the attacker to already possess elevated privileges within the application.\nDefenders must apply vendor-supplied updates or restrict administrative access to mitigate the associated risks.",
  "technicalDetails": "The vulnerability resides within WhatsUp Gold in versions released before 2026.0.2, specifically concerning insufficient validation or sanitization mechanisms when handling file write operations.\nThe root cause stems from insecure file handling routines that allow an adversary with administrative privileges to dictate file destination paths and write arbitrary content to disk.\nBecause the target location is web-accessible, any file written via this mechanism can be directly requested and potentially executed by the web server context.\nTo exploit this vulnerability, an attacker follows a specific attack flow: first, authenticating to the application with the necessary high-level privileges; second, interacting with the vulnerable administrative component or endpoint responsible for file generation or transfer; and third, supplying a maliciously crafted payload targeted at a web-accessible directory.\nUpon successful processing by the application, the arbitrary file is written to the specified path on the host server.\nThe authentication requirement is privileged, meaning unauthenticated users cannot trigger this specific flaw directly without prior credential compromise or session hijacking.\nNetwork exposure includes the administrative interface of the application, which is typically accessible over HTTP or HTTPS.\nPost-exploitation impact encompasses potential web shell deployment, execution of arbitrary commands under the privileges of the web service account, persistence establishment, and lateral movement within the network."
}