TIMEPICTRA · CVE-2026-8331 · Infrastructure
FIX → 12.0 ✓ verified
Microchip's TimePictra platform before 12.0 does not properly restrict file uploads. Per Microchip, an authenticated, low-privileged attacker can upload a dangerous file and execute code, compromising the platform and connected systems. Fixed in TimePictra 12.0.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
TimePictra is a time-synchronization management platform, so exposure depends on whether a deployment's upload functionality is reachable by an attacker. The sources do not name affected versions or the specific configuration needed. unknown
Not affected if timepictra-12.0-or-later, web-app-not-reachable-by-untrusted-users
Who cares authenticated, microchip, self-hosted, time-sync, timepictra
Upgrade to 12.0
Upgrade to TimePictra 12.0 platform or later
An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.