CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-9827 — A arbitrary file write vulnerability exists in the boa formUploadFile functional...

·Source: NIST NVD

Updated:

Executive Summary

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Analysis

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. CVSS Score: 9.1. Published: 2026-10-20T21:17:23.020.

Indicators of Compromise (1)

CVE (1)
CVE-2026-9827
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 20, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

How PHP's Coordinated Disclosure Process Went Belly Up

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/how-phps-coordinated-disclosure-process-went-belly-up-image_small-7-a-33176.jpg" align=right hspace=4><b>Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024</b><br>The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn't. A demonstration video of a

Bank Info Security
MEDIUMVulnerabilityNEW

Microsoft shares how to fix broken Exchange Online EWS apps

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

Fireblocks pours cold water on reports of $2.5bn acquisition talks with Visa

Digital asset and stablecoin infrastructure provider Fireblocks says that reports that it is in talks to be acquired by Visa for $2.5 billion are "news to us".

Finextra