CVE-2026-40552

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40552", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-04-14T09:44:32.552Z", "datePublished": "2026-04-28T13:13:44.914Z", "dateUpdated": "2026-09-30T11:18:19.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-09-30T11:18:19.667Z"}, "title": "Remote Code Execution in multiple BinSoft products", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-669", "description": "CWE-669: Incorrect Resource Transfer Between Spheres", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253: Remote Code Inclusion"}]}], "affected": [{"vendor": "BinSoft", "product": "mpGabinet", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "23.12.19", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFirma", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "26.4.9", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFaktura", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "26.4.9", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFirma ERP", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "26.4.9", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpSekretariat", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "25.2.4", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpPOS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "25.2.4", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpCRM", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "25.2.4", "versionType": "semver"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpWarsztat", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "20.4.28", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Multiple BinSoft products are\u00a0vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.\nCritically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.\n\nThe described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Multiple BinSoft products are&nbsp;vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.<br>Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.<br><br>The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.&nbsp;"}]}], "references": [{"url": "https://cert.pl/posts/2026/04/CVE-2026-40550/", "tags": ["third-party-advisory"]}, {"url": "https://www.binsoft.pl/produkty", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.7, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Robert Kruczek", "type": "finder"}, {"lang": "en", "value": "Kamil Szczurowski", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-28T14:16:34.596557Z", "id": "CVE-2026-40552", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:16:41.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40552", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T14:16:34.596557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:16:37.744Z"}}], "cna": {"title": "Remote Code Execution in multiple BinSoft products", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Robert Kruczek"}, {"lang": "en", "type": "finder", "value": "Kamil Szczurowski"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253: Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BinSoft", "product": "mpGabinet", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "23.12.19"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFirma", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.4.9"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFaktura", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.4.9"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpFirma ERP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.4.9"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpSekretariat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.2.4"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpPOS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.2.4"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpCRM", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.2.4"}], "defaultStatus": "affected"}, {"vendor": "BinSoft", "product": "mpWarsztat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20.4.28"}], "defaultStatus": "affected"}], "references": [{"url": "https://cert.pl/posts/2026/04/CVE-2026-40550/", "tags": ["third-party-advisory"]}, {"url": "https://www.binsoft.pl/produkty", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Multiple BinSoft products are\u00a0vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.\nCritically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.\n\nThe described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.", "supportingMedia": [{"type": "text/html", "value": "Multiple BinSoft products are&nbsp;vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.<br>Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.<br><br>The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-669", "description": "CWE-669: Incorrect Resource Transfer Between Spheres"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-09-30T11:18:19.667Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40552", "state": "PUBLISHED", "dateUpdated": "2026-09-30T11:18:19.667Z", "dateReserved": "2026-04-14T09:44:32.552Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-28T13:13:44.914Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "mpGabinet", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "23.12.19", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpFirma", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "26.4.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpFaktura", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "26.4.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpFirma ERP", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "26.4.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpSekretariat", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "25.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpPOS", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "25.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpCRM", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "25.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "mpWarsztat", "vendor": "BinSoft", "versions": [{"lessThanOrEqual": "20.4.28", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple BinSoft products are\u00a0vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.\nCritically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.\n\nThe described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual."}, {"lang": "es", "value": "M\u00faltiples productos BinSoft son vulnerables a la Ejecuci\u00f3n Remota de Comandos. Un usuario autorizado con acceso a la aplicaci\u00f3n y acceso directo a la base de datos de backend puede lograr la ejecuci\u00f3n de comandos del sistema al cargar un archivo adjunto y modificar su ruta de almacenamiento en la base de datos para hacer referencia a un recurso de red remoto controlado por un atacante. Alternativamente, es posible usar un archivo cargado previamente y cambiar su referencia. Cuando la aplicaci\u00f3n procesa el archivo adjunto, y un usuario intenta abrirlo, el recurso referenciado es ejecutado por el sistema.\nCr\u00edticamente, esta vulnerabilidad puede ser explotada por cualquier atacante no autenticado encaden\u00e1ndola con CVE-2026-40550 y CVE-2026-40551, lo que permite obtener acceso a la base de datos e iniciar sesi\u00f3n en cualquier cuenta.\n\nEl problema descrito afecta a todas las versiones publicadas. El proveedor declar\u00f3 que este problema es un resultado directo del modelo de arquitectura en el que se distribuye el software, y que se mitigar\u00e1 con un manual de instalaci\u00f3n corregido."}], "id": "CVE-2026-40552", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40552", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-28T14:16:34.596557Z", "version": "2.0.3"}}]}, "published": "2026-04-28T14:16:13.637", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/04/CVE-2026-40550/"}, {"source": "cvd@cert.pl", "url": "https://www.binsoft.pl/produkty"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,23.12.19]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mpGabinet", "source": "cna", "vendor": "BinSoft"}, "product": "mpgabinet", "vendor": "binsoft"}], "created": "2026-04-28T19:30:27.366341+00:00", "updated": "2026-10-01T23:45:14.555166+00:00", "vendors": ["binsoft", "binsoft$PRODUCT$mpgabinet"]}