CVE-2026-76157: Datiphy Data Management Center - Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the affected upload API endpoint. No account or prior authentication is required.
Which deployments are affected?
Datiphy Data Management Center versions v8.3.0 through v8.5.1 are affected. The issue applies to the upload API endpoint and permits uploads to the server's configured upload directory.
What is the immediate impact of successful exploitation?
An attacker can upload arbitrary files to the server's configured upload directory. The provided information does not state whether uploaded files can be executed or otherwise accessed through the application.