CVE-2026-8331 PUBLISHED

TimePictra ermote code execution via file upload

Assigner: Microchip
Reserved: 11.05.2026 Published: 12.11.2026 Updated: 12.11.2026

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.8

Product Status

Vendor Microchip
Product TimePictra
Versions Default: unaffected
  • affected from 0 to 12.0 (excl.)

Solutions

Upgrade to TimePictra 12.0 platform or later

Credits

  • Dario Emilio Bertani finder
  • Andrea Sindoni finder
  • Antonio Carriero finder
  • Marco Manieri finder
  • Vito Pistillo finder
  • Davide Renna finder
  • Manuel Leone finder
  • TIM Security Red Team Research reporter

References

Problem Types

  • CWE-434 Unrestricted upload of file with dangerous type CWE

Impacts

  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs