---
id: "CVE-2026-8331"
page: "https://infrastack.ai/live/CVE-2026-8331"
kind: "vulnerability"
aliases: ["CVE-2026-8331"]
title: "Microchip TimePictra before 12.0: low-privileged user can upload a file and run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TimePictra", "fixed": ["12.0"], "affected": "< 12.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "infrastructure", "microchip", "self-hosted", "time-sync", "timepictra"]
not_affected_if: ["timepictra-12.0-or-later", "web-app-not-reachable-by-untrusted-users"]
published_at: "2026-11-12T07:16:47+00:00"
first_seen_at: "2026-11-12T07:37:04+00:00"
updated_at: "2026-11-12T07:39:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8331", "first_seen_at": "2026-11-12T07:37:04+00:00"}, {"source": "analyst", "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload", "first_seen_at": "2026-11-12T07:39:28+00:00", "cites": ["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload"]}]
exploit_sources: []
---

# Microchip TimePictra before 12.0: low-privileged user can upload a file and run code

Link for people: https://infrastack.ai/live/CVE-2026-8331 (this .md is for agents)

Microchip's TimePictra platform before 12.0 does not properly restrict file uploads. Per Microchip, an authenticated, low-privileged attacker can upload a dangerous file and execute code, compromising the platform and connected systems. Fixed in TimePictra 12.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TimePictra affected < 12.0 fixed 12.0

## How to check

Check the installed TimePictra platform version (admin UI/about page); any version before 12.0 is affected. Also check whether the web application is reachable from untrusted networks.

## Fix

Upgrade to TimePictra 12.0 platform or later

## Timeline

- 2026-11-12T07:37:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8331
- 2026-11-12T07:39:28+00:00 analyst https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload — Read Microchip PSIRT-137: before 12.0 affected, fixed in 12.0, auth required (low-privileged). No exploitation/PoC evidence checked on social; no check written (appliance version not in repos).

## Documents

- [advisory] Microchip PSIRT-137: TimePictra RCE via file upload https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload

## From the sources

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_