TI-2026-01974 Aliases CVE-2026-2334 GHSA-cxgp-6h9c-hfpc

) Missing Server-Side File Extension Validation in vsDesk

MEDIUM 44CWE-434Published 2026-08-20 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0072 54th percentileScored 2026-11-07

Fix Fixed vsDesk (vsDesk): 14.0402

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vsDesk	vsDesk	14.0101	14.0402	Patch available	CNA

vsDesk VendorvsDesk Affected 14.0101 Fixed in 14.0402 Patch available CNA

Remediation

Fix · CNA vsDesk (vsDesk) Fixed in 14.0402

Timeline

2026-10-02 Threatist record created from CVE-2026-2334
2026-10-03 Alias added: GHSA-cxgp-6h9c-hfpc

References

Other 2

TI-2025-13340 Admin Account Takeover via Path Traversal in vsDesk CVSS 4.0CRITICAL 9.3
TI-2025-13343 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection CVSS 4.0HIGH 8.8
TI-2025-13341 vsDesk Task Scheduler OS Command Injection CVSS 4.0HIGH 8.6
TI-2025-13342 Weak File Name Generation in vsDesk CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences