CVE-2026-117469
Medium
Description
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
SeverityMedium
CVSS5.4
Exploit probability—
ProductPsono
PublishedOct 27, 2026
First seenOct 27, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- esaqa GmbH Psono7.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| esaqa GmbH Psono | 1.0.0 ≤ v < 7.2.4 | 7.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.