Source: ocsinventory-server Version: 2.8.1+dfsg1+~2.11.1-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for ocsinventory-server. CVE-2026-76174[0]: | Unrestricted file upload vulnerability in the CSV file upload | functionality of the Ocsreports admin_info endpoint. The application | validates files solely based on the name provided by the client, | without properly checking their content or securely restricting the | permitted file types. This allows a user with administrator | privileges to upload PHP files to a directory accessible via the web | interface. If the file is subsequently processed by the server, an | attacker could execute arbitrary code with the privileges of the | account used by the web service. CVE-2026-76175[1]: | SQL injection vulnerability in the del_check parameter of the | /ocsreports/?function=save_query_list endpoint. Input provided by an | authenticated user with operator privileges is incorporated into an | SQL query without proper parameterisation or validation, allowing | the query to be manipulated and information to be extracted from the | database using SQL injection techniques. CVE-2026-76176[2]: | SQL injection vulnerability in the endpoint | /ocsreports/index.php?function=admin_double due to improper | processing of the values in the ID field included in the | selected_grp_dupli[] parameter. An authenticated user with operator | privileges can manipulate these values to alter the SQL queries | executed by the application and retrieve information stored in the | database. CVE-2026-76177[3]: | Server-Side Request Forgery (SSRF) vulnerability in the | /ocsreports/?function=tele_activate endpoint due to insufficient | validation of the HTTPS_SERV and FILE_SERV parameters. An | authenticated user with operator privileges can provide arbitrary | values for these parameters, causing the OCS Inventory server to | make HTTP/HTTPS requests to external systems or internal resources, | which could allow access to internal network services or metadata | resources of cloud services. CVE-2026-76178[4]: | A stored Cross-Site Scripting (XSS) vulnerability in the | notification template functionality of the endpoint | /ocsreports/?function=notification. A user with administrator | privileges can input malicious HTML content which is subsequently | stored and displayed without proper sanitisation when other | administrators access the template customisation view, allowing | JavaScript code to be executed within the application’s security | context and potentially compromising the sessions of other users | with administrative privileges. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-76174 https://www.cve.org/CVERecord?id=CVE-2026-76174 [1] https://security-tracker.debian.org/tracker/CVE-2026-76175 https://www.cve.org/CVERecord?id=CVE-2026-76175 [2] https://security-tracker.debian.org/tracker/CVE-2026-76176 https://www.cve.org/CVERecord?id=CVE-2026-76176 [3] https://security-tracker.debian.org/tracker/CVE-2026-76177 https://www.cve.org/CVERecord?id=CVE-2026-76177 [4] https://security-tracker.debian.org/tracker/CVE-2026-76178 https://www.cve.org/CVERecord?id=CVE-2026-76178 Regards, Salvatore
