CVE-2026-80237: Thinking Software Technology｜Efence - Arbitrary File Upload
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thinking Software Technology Efenceto a version that resolves this vulnerability.Fixed in 1.2.67Patch DB Ver:57
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this vulnerability?
An attacker needs valid authentication to the EFence application. No user interaction is required once the attacker has authenticated.
What is the likely impact if exploitation succeeds?
An authenticated remote attacker can upload and execute a web shell backdoor. This can result in arbitrary code execution on the affected server, with confidentiality, integrity, and availability impacts rated high.
Can affected installations be identified from the available advisory data?
The provided data identifies Thinking Software Technology EFence as affected but does not provide affected or fixed version numbers, configuration conditions, or detection indicators.