CVE-2026-86272: Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload

Published Sep 7, 2026

Updated

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

Beijing Meite Software Technology U+Smart Enjoyment WebSite=18.6001.1096.1000

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx from your environment.
Remove/uninstall the vulnerable UploadFormImg.ashx component to eliminate the unrestricted file upload vector.

Event History

Sep 7, 2026

CVE Published

via MITRE·04:45 AM

Data Sourced

via MITRE·04:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability can be exploited remotely and does not require privileges or user interaction according to the supplied CVSS vector. An attacker needs to be able to send a crafted request to the affected upload handler, /Report/Upload/UploadFormImg.ashx.

Is public exploit information available?

Yes. The exploit has been publicly disclosed and may be used by attackers.

Which version is identified as affected?

The reported affected version is U+Smart Enjoyment WebSite 18.6001.1096.1000. The provided information does not establish whether earlier or later versions are affected.