CVE-2026-5261 | Shandong Hoteam InforCenter PLM up to 8.3.8 /Base/BaseHandler.ashx uploadFileToIIS File unrestricted upload

A vulnerability marked as critical has been reported in Shandong Hoteam InforCenter PLM up to 8.3.8. The impacted element is the function uploadFileToIIS of the file /Base/BaseHandler.ashx. The manipulation of the argument File leads to unrestricted upload.

This vulnerability is traded as CVE-2026-5261. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.