CVE-2026-91844: Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip

Q: Which versions need remediation?

The issue affects eimzamip versions from 1.6.4 up to, but not including, 1.6.6. Upgrade to version 1.6.6 or later if available.

Q: What access does an attacker need?

The vector indicates network-reachable exploitation with low attack complexity, but an attacker must have low-level privileges and convince a user to interact with the malicious upload.

Q: What is the potential impact?

Successful exploitation can result in high confidentiality and integrity impact. Availability impact is rated as none.

Published Oct 8, 2026

Updated

Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.

This issue affects eimzamip: from v1.6.4 before v1.6.6.

Affected Software

1 affected component

İzometri eimzamip>=1.6.4<1.6.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade eimzamip to a version that resolves this vulnerability.
Fixed in 1.6.6

Event History

Oct 8, 2026

CVE Published

via MITRE·01:42 PM

Data Sourced

via MITRE·01:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions need remediation?

The issue affects eimzamip versions from 1.6.4 up to, but not including, 1.6.6. Upgrade to version 1.6.6 or later if available.

What access does an attacker need?