CVE-2026-39759

Summary

This vulnerability allows an attacker to upload arbitrary files by exploiting a flaw in the file upload mechanism of Workreap Core versions 3.4.5 and earlier, potentially leading to remote code execution or data compromise.

Exploitability

Exploitation is relatively straightforward given the arbitrary file upload capability, requiring an authenticated sales representative or employer account.

Blast radius

If exploited, the impact could be severe, including unauthorized access to sensitive data, execution of malicious code, or complete compromise of the affected system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Workreap Core version 3.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.