CVE-2026-71379: Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties
Published Sep 29, 2026
·Updated
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
Affected Software
2 affected components
Toptech TMS7
Toptech TopHAT
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Toptech TMS7to a version that resolves this vulnerability.Fixed in 7.8
Event History
Sep 29, 2026
CVE Published
via MITRE·09:23 PM
Data Sourced
via MITRE·09:23 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require credentials or user interaction?
No. The vulnerability is described as exploitable by an unauthenticated attacker, with no user interaction required.
2
What access does successful exploitation provide?
An attacker can export arbitrary database tables through the file export endpoint. The reported impact includes high confidentiality, integrity, and availability impact.
3
Which deployments should be reviewed?
Review deployments of Toptech TMS7 and Toptech TopHAT, especially where the file export endpoint is reachable over the network. The provided data does not identify affected or fixed version ranges.