Discovered and Published by: LHS
Published date: 2026-09-19
CVE ID: CVE-2026-88738
Status: Public Advisory
An unrestricted file upload vulnerability was identified in the upgrade package upload functionality of Jazzware webUI v. 20.0.1.
The issue allows an authenticated user with access to the upgrade upload function to upload server-side executable content. In the tested deployment, the uploaded file was stored in a web-accessible executable location and could be accessed directly over HTTP without authentication, resulting in remote code execution.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-88738 |
| Product | Jazzware RT1000 Edge webUI |
| Vendor | Jazzware, Inc |
| Tested Version | v. 20.0.1 |
| Affected Version | v. 20.0.1 verified |
| Vulnerability Type | Unrestricted File Upload |
| CWE | CWE-434: Unrestricted Upload of File with Dangerous Type |
| Impact | Remote Code Execution |
| Discovery Credit | LHS, Security Researcher |
At the time of publication, only version 20.0.1 has been verified as affected. The full affected version range and fixed version information were not confirmed at the time this advisory was prepared.
If additional affected version ranges, fixed versions, advisory links, release notes, or remediation details become available later, this advisory and the CVE record may be updated accordingly.
Suggested CVSS v3.1 vector:
**7.2 High** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H