Riskcovery

CVE-2026-65939

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

State
Published
Severity
6.8 Medium
Published
Aug 12, 2026
Updated
Aug 13, 2026
Reserved
Jul 23, 2026

Read the record on cve.org

Description

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HProgressSoftware

Weaknesses

  • CWE-434 Unrestricted upload of file with dangerous type
  • CWE-73 External control of file name or path
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
WhatsUp GoldProgress Software Corporation
  • before 26.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.