CVE-2026-7395: High severity CGI Asset Suite vulnerability
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Use HTTPPublishAdapterTestServlet only in non-production environments.
Event History
Frequently Asked Questions
Which deployments are most likely exposed?
Deployments where HTTPPublishAdapterTestServlet is accessible are exposed. The servlet is intended for testing in non-production environments, so production systems that retain it or make it reachable should be prioritized for review.
What does an attacker need to exploit this issue?
The issue can be exploited by an unauthenticated user who can access HTTPPublishAdapterTestServlet. No authenticated account is required according to the available information.
What is the impact of successful exploitation?
An attacker can use the servlet for configuration file upload, which can lead to information disclosure and compromise the integrity of the affected system or its configuration.
What can be done while a permanent fix is unavailable?
Restrict unauthenticated access to HTTPPublishAdapterTestServlet and ensure it is not exposed in production. Because the servlet is intended for non-production testing, remove or disable it where it is not required.