CVE-2026-0522 identifies a local file inclusion vulnerability within the upload/download flow of VertiGIS FM version 10.5.00119. Authenticated attackers can exploit this by manipulating file paths during upload to read arbitrary files from the server. This high-severity vulnerability (CVSS 7.4) could lead to remote code execution by obtaining sensitive files like "web.config" and enables NTLM-relaying attacks via UNC path resolution. Exploitation requires low privileges and no user interaction. There is currently no evidence of active exploitation, nor is public exploit code available, though it has received minimal community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
10.11.363CPE matchmatch criteria | cpe:2.3:a:vertigis:fm:10.11.363:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.