CVE-2026-8331

{
  "etk_id": "ETK-2026-4265",
  "cve_id": "CVE-2026-8331",
  "display_id": "CVE-2026-8331",
  "ghsa_id": "GHSA-5993-pcpw-x8xp",
  "euvd_id": "EUVD-2026-124293",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted dangerous file upload in Microchip TimePictra",
  "summary": "Microchip TimePictra is affected by an unrestricted file-upload flaw involving dangerous file types. An attacker who can access upload functionality that is not adequately restricted by access control lists may be able to cause remote code execution.",
  "mitigation": "Disable or restrict file-upload functionality to authorized users, enforce allowlisted file types, and prevent uploaded files from being executed. Apply a vendor-provided update when an applicable fixed release is identified; the evidence does not name one.",
  "vendor": "Microchip",
  "product": "TimePictra",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 12.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "12.0"
      ],
      "package_name": "TimePictra",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.284371433333334,
  "t0_at": "2026-11-12T06:21:04.118000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T06:21:04.118000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T06:21:04.118000+00:00",
      "url": "https://github.com/advisories/GHSA-5993-pcpw-x8xp"
    }
  }
}