Openwave Webtop Media Transcoder ignores file type restrictions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Openwave Webtop Media Transcoder versions from 0 before 1.1.22.0 do not enforce administrator-defined file type restrictions on which file types are converted. An authenticated user with low privileges can process and convert document types that the administrator did not intend to allow, by bypassing the Webmail experience. The weakness is classified as CWE-669.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Openwave Messaging (Ireland) Limited | Webtop Media Transcoder | before 1.1.22.0 | 1.1.22.0 | Patch available | CNA |
- Webtop Media Transcoder VendorOpenwave Messaging (Ireland) Limited Affected before 1.1.22.0 Fixed in 1.1.22.0 Patch available CNA
Remediation
Upgrade Openwave Webtop Media Transcoder to version 1.1.22.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Webtop Media Transcoder (Openwave Messaging (Ireland) Limited) Fixed in 1.1.22.0
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111793
- 2026-10-18 Alias added: GHSA-5353-r4qc-2252
- 2026-10-19 CISA SSVC decision points changed
References
Sources
- CVE-2026-111793 · CVE Program
- CVE-2026-111793 · NVD
- FIRST EPSS
- GHSA-5353-r4qc-2252 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences