CVE-2026-71379

CRITICAL

Published Sep 29, 2026 Modified Sep 30, 2026 CWE-552

Description

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

Is your site exposed to CVE-2026-71379?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0044

Probability of exploitation

0.37%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-552 CWE-552

References

Other References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02 https://www.toptech.com/blog/tms7-version-7-8-strengthens-security

Frequently Asked Questions

What is CVE-2026-71379? +

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. It has a CVSS v3.1 base score of 10.0 (CRITICAL).

How severe is CVE-2026-71379? +

CVE-2026-71379 has a CVSS v3.1 score of 10.0 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0044, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-71379? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-29080

Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to …

CVE-2025-1982

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file …

CVE-2026-109162

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ …

CVE-2026-76531

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. …

CVE-2025-22369

The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from …

CVE-2025-34139

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow …