CVE-2026-1021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1021", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "REJECTED", "assignerShortName": "twcert", "dateReserved": "2026-01-16T02:00:24.357Z", "datePublished": "2026-01-16T03:08:42.422Z", "dateUpdated": "2026-07-30T06:01:36.246Z", "dateRejected": "2026-07-30T06:01:36.246Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-07-30T06:01:36.246Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.4"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1021", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "REJECTED", "assignerShortName": "twcert", "dateReserved": "2026-01-16T02:00:24.357Z", "datePublished": "2026-01-16T03:08:42.422Z", "dateUpdated": "2026-07-30T06:01:36.246Z", "dateRejected": "2026-07-30T06:01:36.246Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-07-30T06:01:36.246Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.4"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-1021", "lastModified": "2026-10-16T14:10:00.120", "metrics": {}, "published": "2026-01-16T03:16:18.817", "references": [], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Rejected"}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:50:56.673690+00:00", "value": {"mitigation_remediation": ["Upgrade the Police Statistics Database System to version 1.0.3 or later, which eliminates the arbitrary file upload flaw.", "Until the update can be applied, disable or restrict the file upload functionality on the affected web endpoints to prevent unauthenticated file placement.", "Implement strict server\u2011side validation to accept only approved file types and MIME types, reject executable extensions, and monitor the upload directory for unauthorized changes.", "Deploy a Web Application Firewall rule set that blocks suspicious upload attempts and detects web shell execution patterns."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "This issue affects all deployments of the Gotac Police Statistics Database System running versions earlier than 1.0.3. The vendor has released an update (1.0.3 or later) that removes the unsafe upload functionality, so systems still on older versions are vulnerable.", "description_and_impact": "The vulnerability in the Gotac Police Statistics Database System is an arbitrary file upload flaw that allows an unauthenticated attacker to place any file, including executable web shells, onto the server. This defect, classified as CWE-434, enables an attacker to execute arbitrary code with the privileges of the web application, potentially compromising the entire system, data, and surrounding network.", "risk_and_exploitability": "Based on the description, it is inferred that the flaw can be exploited remotely over the web interface without authentication. An attacker who can reach the upload endpoint can upload a malicious file, leading to arbitrary code execution. The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the KEV catalog, but the potential impact remains high."}}}}, "created": "2026-01-16T13:41:56.286732+00:00", "updated": "2026-04-18T06:00:08.490999+00:00", "vendors": ["gotac", "gotac$PRODUCT$statistical_database_system"]}