VertiGIS FM LFI and Reflected XSS Vulnerabilities (CVE-2026-0522/3877)

Vulnerability Summary: VertiGIS FM Security Advisory 1. Vulnerability Overview This advisory covers two critical security vulnerabilities in VertiGIS FM software: CVE-2026-0522: Local File Inclusion (LFI) during file upload/download processes. CVSS Score: 7.4 (High) Description: An attacker can manipulate the file upload path to read arbitrary files on the server. Due to the ASP.NET architecture, this may lead to Remote Code Execution (RCE), particularly when the file is accessed. CVE-2026-3877: Reflected Cross-Site Scripting (XSS). CVSS Score: 7.3 (High) Description: A reflected XSS vulnerability exists in the dashboard search functionality. Attackers can craft malicious URLs to trick victims into visiting them, thereby executing arbitrary JavaScript. 2. Scope of Impact Local File Inclusion (CVE-2026-0522): This vulnerability was discovered in VertiGIS FM version 10.5.00119. According to vendor information, versions prior to 10.11.363 are affected. Reflected XSS (CVE-2026-3877): This vulnerability was identified in a test environment. According to vendor information, versions prior to 10.13.493 are affected. 3. Remediation Version Upgrade: It is recommended to upgrade to version 10.11.363 (for Local File Inclusion) and 10.13.493 (for Reflected XSS) or later. Configuration Restrictions: Configure process permissions to limit access to only necessary files. Configure network restrictions to ensure the application is accessible only within specific ranges. Firewall Rules: Implement firewall rules to restrict connections, allowing only necessary traffic. 4. Proof of Concept (PoC) Code Exploit Code for Vulnerability CVE-2026-0522 (LFI) Step 1: Upload File Step 2: Server Response (Returns Temporary File Path) Step 3: Read Arbitrary File (Utilizing UNC Path) (Note: The request body contains the malicious path ) Step 4: Server Response (Returns File Content) Exploit Code for Vulnerability CVE-2026-3877 (XSS) Malicious URL Example: (Note: The parameters in the URL are reflected into HTML script tags, resulting in XSS)*

Goal Reached Thanks to every supporter — we hit 100%!

VertiGIS FM LFI and Reflected XSS Vulnerabilities (CVE-2026-0522/3877)