Skip to content
OpenAdvisories
Critical · 10.0 CVE-2025-59818 EUVD-2025-206811GHSA-54w5-95mr-m6mw

Authenticated Remote Code Execution via the file name of an uploaded file

Published Feb 4, 2026 · Updated Feb 4, 2026 · Assigned by NCSC-NL

Vendor: Zenitel Product: TCIS-3+

Description

This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.

Affected products

VendorProductAffectedFixed
Zenitel TCIS-3+ <9.2.3.3 —

References