ghsa:GHSA-QV4M-M73M-8HJ7: notrinos/notrinos-erp <= 1.0.0

NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file). Affected range: <= 1.0.0.

Affected technology

notrinos/notrinos-erp · <= 1.0.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Summary An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an arbitrary extension through the employee **Documents** tab. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 25-Oct-2026 21:12 UTC

Product: notrinos/notrinos-erp
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-25 21:12:26.049299+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-qv4m-m73m-8hj7.html