{"id":"CVE-2026-8331","kind":"vulnerability","aliases":["CVE-2026-8331"],"related":[],"title":"Microchip TimePictra before 12.0: low-privileged user can upload a file and run code","description":"An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.","summary":"Microchip's TimePictra platform before 12.0 does not properly restrict file uploads. Per Microchip, an authenticated, low-privileged attacker can upload a dangerous file and execute code, compromising the platform and connected systems. Fixed in TimePictra 12.0.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TimePictra","fixed":["12.0"],"affected":"< 12.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","infrastructure","microchip","self-hosted","time-sync","timepictra"],"not_affected_if":["timepictra-12.0-or-later","web-app-not-reachable-by-untrusted-users"],"how_to_check":"Check the installed TimePictra platform version (admin UI/about page); any version before 12.0 is affected. Also check whether the web application is reachable from untrusted networks.","fix":"Upgrade to TimePictra 12.0 platform or later","status":"open","published_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","triaged_at":"2026-11-12T07:38:07+00:00","updated_at":"2026-11-12T07:39:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T07:38:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Microchip TimePictra: unrestricted file upload allows remote code execution","impact":"high","summary":"Microchip's TimePictra platform accepts uploads of files with dangerous types without restricting them by access control. An attacker who can reach it may be able to run code remotely on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["timepictra","microchip","time-sync"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote code execution on the TimePictra server","analyst_note":"Find the vendor advisory and affected versions for TimePictra, and whether authentication is required for the upload path (see https://nvd.nist.gov/vuln/detail/CVE-2026-8331).","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"TimePictra is a time-synchronization management platform, so exposure depends on whether a deployment's upload functionality is reachable by an attacker. The sources do not name affected versions or the specific configuration needed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4516,"output_tokens":442,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected versions for TimePictra, and whether authentication is required for the upload path (see https://nvd.nist.gov/vuln/detail/CVE-2026-8331).","search":"'-2026':17A,20A '-8331':18A,21A '12.0':4A,38B,70B 'access':91C 'allow':85C 'attack':52B 'authent':23B,48B 'code':15A,60B,98C 'compromis':61B 'connect':65B 'constrain':89C 'control':92C 'cve':16A,19A 'danger':56B,77C 'execut':59B,99C 'file':12A,43B,57B,75C 'fix':67B 'function':86C 'host':28B 'infrastructur':24B 'list':93C 'low':6A,50B 'low-privileg':5A,49B 'microchip':1A,25B,33B,46B,82C 'per':45B 'platform':36B,63B,84C 'potenti':94C 'privileg':7A,51B 'proper':41B,88C 'remot':97C 'restrict':42B 'result':95C 'run':14A 'self':27B 'self-host':26B 'sync':31B 'system':66B 'time':30B 'time-sync':29B 'timepictra':2A,22A,32B,35B,69B,83C 'type':78C 'unrestrict':72C 'upload':10A,44B,54B,73C 'user':8A 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"TimePictra is a time-synchronization management platform, so exposure depends on whether a deployment's upload functionality is reachable by an attacker. The sources do not name affected versions or the specific configuration needed. unknown","tier":"B","verified":{"fix":{"at":"2026-11-12T07:39:28Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","run_id":3716},"products":{"at":"2026-11-12T07:39:28Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","run_id":3716},"how_to_check":{"at":"2026-11-12T07:39:28Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","run_id":3716},"who_affected":{"at":"2026-11-12T07:39:28Z","by":"analyst","doc":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","run_id":3716}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["timepictra"],"ptokens":["timepictra"],"labels":["authenticated","high","infrastructure","microchip","selfhosted","timepictra","timesync"],"campaign_type":null,"search_a":"'-2026':17A,20A '-8331':18A,21A '12.0':4A 'code':15A 'cve':16A,19A 'file':12A 'low':6A 'low-privileg':5A 'microchip':1A 'privileg':7A 'run':14A 'timepictra':2A,22A 'upload':10A 'user':8A","search_b":"'12.0':38B,70B 'attack':52B 'authent':23B,48B 'code':60B 'compromis':61B 'connect':65B 'danger':56B 'execut':59B 'file':43B,57B 'fix':67B 'host':28B 'infrastructur':24B 'low':50B 'low-privileg':49B 'microchip':25B,33B,46B 'per':45B 'platform':36B,63B 'privileg':51B 'proper':41B 'restrict':42B 'self':27B 'self-host':26B 'sync':31B 'system':66B 'time':30B 'time-sync':29B 'timepictra':32B,35B,69B 'upload':44B,54B","search_c":"'access':91C 'allow':85C 'code':98C 'constrain':89C 'control':92C 'danger':77C 'execut':99C 'file':75C 'function':86C 'list':93C 'microchip':82C 'platform':84C 'potenti':94C 'proper':88C 'remot':97C 'result':95C 'timepictra':83C 'type':78C 'unrestrict':72C 'upload':73C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8331","severity":null,"published_at":"2026-11-12T07:16:47+00:00","modified_at":"2026-11-12T07:16:47+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","fetched_at":"2026-11-12T07:37:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8331:3716","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","severity":null,"published_at":"2026-11-12T07:39:28+00:00","modified_at":"2026-11-12T07:39:28+00:00","first_seen_at":"2026-11-12T07:39:28+00:00","fetched_at":"2026-11-12T07:39:28+00:00","note":"Read Microchip PSIRT-137: before 12.0 affected, fixed in 12.0, auth required (low-privileged). No exploitation/PoC evidence checked on social; no check written (appliance version not in repos).","cites":["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload"]}],"documents":[{"id":132939,"url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload","title":"Microchip PSIRT-137: TimePictra RCE via file upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}