{"id":"CVE-2026-60045","kind":"vulnerability","aliases":["CVE-2026-60045"],"related":[],"title":"Unnamed product lets privileged remote users upload files to guessable paths","description":"A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities.","summary":"A user with high privileges can upload arbitrary files to a location an attacker can guess. The flaw can cause loss of availability and may be chained with other vulnerabilities.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","triaged_at":"2026-11-10T09:21:23+00:00","updated_at":"2026-11-10T09:21:23+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-10T09:21:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Unnamed product lets privileged remote users upload files to guessable paths","impact":"medium","summary":"A user with high privileges can upload arbitrary files to a location an attacker can guess. The flaw can cause loss of availability and may be chained with other vulnerabilities.","audience":"businesses","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"fix_status":"unknown","needs_auth":"yes","worst_case":"uploaded files cause loss of availability, possibly chained further","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60045; the signal lists no products.","how_to_check":"unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":4492,"output_tokens":362,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-60045':14A,17A 'arbitrari':25B,55C 'attack':31B,52C 'avail':40B,68C 'caus':37B 'chain':44B,72C 'cve':12A,15A 'file':8A,26B,56C 'flaw':35B 'guess':33B 'guessabl':10A,59C 'high':21B,49C 'let':3A 'locat':29B,60C 'loss':38B,66C 'may':42B 'might':70C 'path':11A 'privileg':4A,22B,50C 'product':2A 'remot':5A,51C 'result':63C 'unnam':1A 'upload':7A,24B,54C 'user':6A,19B 'vulner':47B,75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other"],"campaign_type":null,"search_a":"'-2026':13A,16A '-60045':14A,17A 'cve':12A,15A 'file':8A 'guessabl':10A 'let':3A 'path':11A 'privileg':4A 'product':2A 'remot':5A 'unnam':1A 'upload':7A 'user':6A","search_b":"'arbitrari':25B 'attack':31B 'avail':40B 'caus':37B 'chain':44B 'file':26B 'flaw':35B 'guess':33B 'high':21B 'locat':29B 'loss':38B 'may':42B 'privileg':22B 'upload':24B 'user':19B 'vulner':47B","search_c":"'arbitrari':55C 'attack':52C 'avail':68C 'chain':72C 'file':56C 'guessabl':59C 'high':49C 'locat':60C 'loss':66C 'might':70C 'privileg':50C 'remot':51C 'result':63C 'upload':54C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60045","severity":null,"published_at":"2026-11-10T09:17:24+00:00","modified_at":"2026-11-10T09:17:24+00:00","first_seen_at":"2026-11-10T09:21:09+00:00","fetched_at":"2026-11-10T09:21:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}