CVE-2026-5261

Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload

State: Published
Severity: 6.9 Medium
Published: Apr 1, 2026
Updated: Apr 3, 2026
Reserved: Mar 31, 2026

Description

A vulnerability was identified in Shandong Hoteam InforCenter PLM up to 8.3.8. The impacted element is the function uploadFileToIIS of the file /Base/BaseHandler.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
InforCenter PLMShandong Hoteam	8.3.0Affected 8.3.1Affected 8.3.2Affected 8.3.3Affected 8.3.4Affected 8.3.5Affected 8.3.6Affected 8.3.7Affected 8.3.8Affected

References

VDB-354450 | Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted uploadvdb-entrytechnical-description
VDB-354450 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #780725 | Shandong Hoteam Software Co., Ltd. Huatian Software InforCenter PLM <8.3.8 Remote Code Executionthird-party-advisory
https://my.feishu.cn/docx/ToGkdd5jwokb4PxEMkHcKrfXn3b?from=from_copylinkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.