AI analysis
CVE-2026-70356 is an unrestricted file-upload flaw (CWE-434) in the TMS file-upload endpoint used by Toptech TMS7 and TopHAT. The endpoint does not enforce server-side file-type checks, so a high-privileged attacker who can reach it over the network can upload a PHP file that the web server then executes. Successful exploitation yields arbitrary code execution on the web server, with high impact to confidentiality, integrity, and availability of the vulnerable system and connected scope (CVSS 4.0 9.4). Affected deployments are terminal-management installations of those Toptech products; exact version ranges are not stated in the available data. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Treat the TMS file-upload endpoint as untrusted until the vendor publishes a fix: require authentication and least privilege, block execution of uploaded content (store uploads outside the web root and deny PHP/script handlers there), and restrict the endpoint to trusted networks. Review web and application logs for unexpected PHP files written via the upload path and remove any that were not intentionally deployed. Apply Toptech’s security update for TMS7 and TopHAT as soon as it is available; no fixed version is identified in the current data.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.