CVE-2026-70356 — Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Published: 2026-09-29 · CVSS: 9.4 · CVSS 4.0
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7