Description
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Toptech Systems | TMS7 | 7.6.3 | 7.8 |
| Toptech Systems | TopHAT | 7.6.3 | 7.8 |
Advisories 1
- ICSA-26-272-02 Toptech TMS7 and TopHAT CISA ICS & IT advisories · Sep 29, 2026