CVE-2026-76174

CVE-2026-76174 is an unrestricted file upload flaw (CWE-434) in the CSV upload feature of the admin_info endpoint of Ocsreports, the web administration console of the open-source OCS Inventory IT asset-management platform. Upload validation relies solely on the client-supplied file name, without inspecting file content or enforcing a strict file-type allow-list, so an authenticated administrator can upload a PHP file into a directory that is reachable through the web interface. If the web server subsequently processes that uploaded PHP file, the attacker's code executes with the privileges of the web service account, resulting in remote code execution on the hosting server. Any organization running Ocsreports where an attacker has (or obtains) administrator credentials is exposed, since the flaw requires high privileges to trigger. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS assigns roughly a 0.5% probability of exploitation within 30 days (40th percentile), so no confirmed exploitation has been reported.

What to do: No fixed version number is included in the available data, so check the OCS Inventory project's release notes and security advisories for a patched Ocsreports build and upgrade as soon as one is available. Until then, restrict the admin_info CSV upload function to trusted administrators, enforce server-side content and extension validation (CSV allow-list), and scan web-accessible upload directories for unexpected .php files. Because exploitation requires administrator privileges, review and harden admin accounts on internet-facing OCS Inventory servers as a priority.