CVE-2026-39619: CSRF in Busiprof Allows Web Shell Upload

The primary impact of CVE-2026-39619 is the ability for an attacker to execute arbitrary code on the affected web server. By leveraging the CSRF vulnerability, an attacker can trick a legitimate user into unknowingly triggering the web shell upload. Once the web shell is deployed, the attacker gains remote code execution capabilities, enabling them to modify files, steal sensitive data, install malware, or pivot to other systems on the network. The blast radius extends to any data stored or processed by the web server, and the attacker could potentially gain full control of the underlying infrastructure.

1. Reserved2026-04-07
2. Published2026-04-08
3. Modified2026-04-29
4. EPSS updated2026-04-15

The recommended mitigation for CVE-2026-39619 is to immediately upgrade Busiprof to version 2.5.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict input validation on file upload endpoints and implementing CSRF protection mechanisms like double-submit cookies or SameSite cookies. Web Application Firewalls (WAFs) configured to detect and block suspicious file uploads can also provide a layer of defense. Monitor web server logs for unusual file uploads or execution attempts.

Plugin rating

4.9