Read the docs
TI-2013-06177 Aliases CVE-2013-10034GHSA-86jp-9w2g-x862

Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE

Priority HIGH 81CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and input sanitation, an attacker can upload a file with an .asp extension to a web-accessible directory, which can then be invoked to execute arbitrary code with the privileges of the IUSR account. The vulnerability enables remote code execution without prior authentication and was resolved in version 6.3.0.2 by removing the vulnerable uploadImage.asp endpoint.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0296 87th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix Fixed KServer (Kaseya): 6.3.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KaseyaKServerbefore 6.3.0.26.3.0.2Patch availableCNA
  • KServer VendorKaseya Affected before 6.3.0.2 Fixed in 6.3.0.2 Patch available CNA

Remediation

  • Fix · CNA KServer (Kaseya) Fixed in 6.3.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-10034
  2. 2026-10-03 Alias added: GHSA-86jp-9w2g-x862

References

Exploit 3

  • TI-2021-10669 2FA bypass in Kaseya VSA <= v9.5.6 CVSS 3.1CRITICAL 9.9
  • TI-2021-10665 Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6 KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-14728 Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-13536 ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-10668 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 CVSS 3.1MEDIUM 5.4
  • TI-2015-05774 Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0… CVSS 3.1CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences