CVE-2026-102454

validated

GHSA-p57c-rwjq-vc7c ↗EUVD-2026-89681 ↗

check availablenot proven exploitable

cve.orgpublic pockev

DigiWin EasyFlow .NET 6.1.*; >= 6.6, <= 6.6.19; >= 8.1, <= 8.1.5

CWE-434 Unrestricted Upload of File with Dangerous Type

ETK-2026-103, permanent identifier

cvss8.6cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

+3h27mTTV

15mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+3h27magent stopped

+1h

+2h

+3h

description

DigiWin EasyFlow .NET is affected by an arbitrary file upload vulnerability. A remote attacker with privileged access may upload and execute server-side backdoors, resulting in code execution on the affected server.

mitigation

Restrict privileged remote access and tightly limit file-upload permissions and executable upload locations. No fixed version is recorded; apply vendor updates when available.

check

available

exploit

automation

contextual

auth required

yes, high privileges

EPSS

0.56%45th percentile

agent run time

15m

cve.org record, t = 0

2026-09-30 08:26Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual check: a technique exists and was validated, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-09-30 08:26Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-102454

this entry in the feed

GET /api/v1/feed/CVE-2026-102454

{
  "etk_id": "ETK-2026-103",
  "cve_id": "CVE-2026-102454",
  "display_id": "CVE-2026-102454",
  "ghsa_id": "GHSA-p57c-rwjq-vc7c",
  "euvd_id": "EUVD-2026-89681",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file upload in DigiWin EasyFlow .NET",
  "summary": "DigiWin EasyFlow .NET is affected by an arbitrary file upload vulnerability. A remote attacker with privileged access may upload and execute server-side backdoors, resulting in code execution on the affected server.",
  "mitigation": "Restrict privileged remote access and tightly limit file-upload permissions and executable upload locations. No fixed version is recorded; apply vendor updates when available.",
  "vendor": "DigiWin",
  "product": "EasyFlow .NET",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "6.1.*",
        ">= 6.6, <= 6.6.19",
        ">= 8.1, <= 8.1.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "EasyFlow .NET",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0056,
  "epss_percentile": 0.4566,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 14.9188098,
  "t0_at": "2026-09-30T08:26:06.973000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T11:52:50.613320+00:00",
      "days": 0.14356065185185185,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T08:26:06.973000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-30T08:26:06.973000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T08:26:06.973000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102454"
    }
  }
}

published 2026-09-30 11:35Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.