CVE-2026-0522

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0522", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2025-12-17T08:22:38.979Z", "datePublished": "2026-04-01T13:11:13.384Z", "dateUpdated": "2026-04-01T13:41:23.300Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-04-01T13:11:13.384Z"}, "title": "Local File Inclusion in the File Upload/Download Process", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-610", "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere", "type": "CWE"}]}], "affected": [{"vendor": "VertiGIS", "product": "VertiGIS FM", "versions": [{"status": "affected", "version": "0", "lessThan": "10.11.363", "versionType": "semver"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vertigis:vertigis_fm:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "10.11.363"}]}]}], "descriptions": [{"lang": "en", "value": "A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.\n\n\n\n\n\n\n\nThis issue affects VertiGIS FM: 10.5.00119 (0d29d428).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div><div><div>A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.</div></div></div></div><p>This issue affects VertiGIS FM: 10.5.00119 (0d29d428).</p>"}]}], "references": [{"url": "https://www.redguard.ch/blog/2026/04/01/advisory-vertigis-vertigisfm/", "tags": ["third-party-advisory", "technical-description"]}, {"url": "https://support.vertigis.com/hc/en-us/articles/31214433137042-Security-Vulnerability-VertiGIS-FM", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P"}}], "credits": [{"lang": "en", "value": "Benjamin Faller, Redguard AG", "type": "finder"}, {"lang": "en", "value": "David Wischnjak, Redguard AG", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:41:03.252558Z", "id": "CVE-2026-0522", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:41:23.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0522", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T13:41:03.252558Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:41:08.971Z"}}], "cna": {"title": "Local File Inclusion in the File Upload/Download Process", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Benjamin Faller, Redguard AG"}, {"lang": "en", "type": "finder", "value": "David Wischnjak, Redguard AG"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VertiGIS", "product": "VertiGIS FM", "versions": [{"status": "affected", "version": "0", "lessThan": "10.11.363", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.redguard.ch/blog/2026/04/01/advisory-vertigis-vertigisfm/", "tags": ["third-party-advisory", "technical-description"]}, {"url": "https://support.vertigis.com/hc/en-us/articles/31214433137042-Security-Vulnerability-VertiGIS-FM", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.\n\n\n\n\n\n\n\nThis issue affects VertiGIS FM: 10.5.00119 (0d29d428).", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div>A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.</div></div></div></div><p>This issue affects VertiGIS FM: 10.5.00119 (0d29d428).</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-610", "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vertigis:vertigis_fm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.11.363", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-04-01T13:11:13.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0522", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:41:23.300Z", "dateReserved": "2025-12-17T08:22:38.979Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-04-01T13:11:13.384Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "VertiGIS FM", "vendor": "VertiGIS", "versions": [{"lessThan": "10.11.363", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "vulnerability@ncsc.ch"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vertigis:fm:10.11.363:*:*:*:*:*:*:*", "matchCriteriaId": "73FCA741-5F96-4AC3-986B-CB6DA8489664", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.\n\n\n\n\n\n\n\nThis issue affects VertiGIS FM: 10.5.00119 (0d29d428)."}, {"lang": "es", "value": "Una vulnerabilidad de inclusi\u00f3n local de ficheros en el flujo de carga/descarga de la aplicaci\u00f3n VertiGIS FM permite a atacantes autenticados leer ficheros arbitrarios del servidor manipulando la ruta de un fichero durante su carga. Cuando el fichero es descargado posteriormente, el fichero en la ruta controlada por el atacante es devuelto. Debido a la arquitectura ASP.NET de la aplicaci\u00f3n, esto podr\u00eda conducir potencialmente a la ejecuci\u00f3n remota de c\u00f3digo cuando se obtiene el fichero \u2019.[]\u2019. Adem\u00e1s, la aplicaci\u00f3n resuelve rutas UNC lo que puede permitir ataques de retransmisi\u00f3n NTLM.\n\nEste problema afecta a VertiGIS FM: 10.5.00119 (0d29d428)."}], "id": "CVE-2026-0522", "lastModified": "2026-11-11T19:10:00.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0522", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:41:03.252558Z", "version": "2.0.3"}}]}, "published": "2026-04-01T14:16:26.397", "references": [{"source": "vulnerability@ncsc.ch", "tags": ["Vendor Advisory"], "url": "https://support.vertigis.com/hc/en-us/articles/31214433137042-Security-Vulnerability-VertiGIS-FM"}, {"source": "vulnerability@ncsc.ch", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.redguard.ch/blog/2026/04/01/advisory-vertigis-vertigisfm/"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-610"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.363)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VertiGIS FM", "source": "cna", "vendor": "VertiGIS"}, "product": "vertigis_fm", "vendor": "vertigis"}], "analysis": {"en": {"generated_at": "2026-04-07T21:30:05.227516+00:00", "value": {"mitigation_remediation": ["Apply the VertiGIS FM security patch for version 10.5.00119 or a newer release as soon as possible.", "If the vendor patch is unavailable, upgrade to the latest VertiGIS FM version that includes the fix.", "Restrict file upload directories to non\u2011privileged locations and enforce strict path validation to prevent manipulation of the download path.", "Disable UNC path resolution in the application configuration unless required by business processes.", "Restrict or monitor access to web.config and other configuration files to prevent unauthorized reading or modification.", "Review server and network logs for signs of unauthorized file reads, NTLM relaying attempts, or malicious upload behavior."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution possible through malicious file upload leading to arbitrary file read"}, "threat_synthesis": {"affected_systems": "The issue is verified against VertiGIS FM version 10.5.00119 (build 0d29d428). All installations running this version or earlier that have not applied the vendor\u2019s fix are considered vulnerable.", "description_and_impact": "VertiGIS FM contains a local file inclusion flaw in its upload/download flow that allows authenticated users to manipulate a file's path to read any file stored on the server. Exploiting this, an attacker can obtain sensitive configuration files such as web.config, which could enable remote code execution on the underlying ASP.NET host. The vulnerability also permits the resolution of UNC paths, opening the possibility of NTLM\u2011relaying attacks if SMB traffic is exposed.", "risk_and_exploitability": "The flaw scores a CVSS of 7.4, indicating a high severity. The EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA\u2019s KEV catalog. Because the attack requires authenticated access to the web application, the vector is the application itself; however, successful exploitation could lead to file disclosure, remote code execution, and possible lateral movement via NTLM relaying. Monitoring for unusual file upload activity and the presence of sensitive files in the webroot is recommended."}}}}, "created": "2026-04-02T07:49:15.306253+00:00", "updated": "2026-04-08T19:59:51.334612+00:00", "vendors": ["vertigis", "vertigis$PRODUCT$vertigis_fm"]}