CVE-2026-10071: Interinfo｜DreamMaker - Arbitrary File Upload

Synopsis

This is an arbitrary file upload vulnerability in Interinfo DreamMaker that lets unauthenticated attackers write web shell files into a location where the server will execute them. The bug is reachable over the network without any login or user interaction, so an attacker who can connect to the application can upload a backdoor and run arbitrary commands as the server process. No fix has been published; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as the vendor ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the DreamMaker HTTP endpoint over the network (AV:N).

• AuthenticationNot required

  No credentials or session are needed; the upload endpoint accepts anonymous requests (PR:N).

• Victim interactionNot required

  Exploitation is driven entirely by the attacker's request, with no user action required (UI:N).

• Attack complexityDetail

  Attack complexity is low: the upload-and-execute flow is reliable and does not depend on timing or environmental conditions (AC:L).

Blast Radius

• Writes attacker-controlled files (typically a JSP or other web shell) into a server-executed path, yielding arbitrary command execution as the DreamMaker process.
• Reads any data the application process can access, including configuration files, database credentials, and stored customer records.
• Modifies or deletes files and database rows reachable from the compromised process, enabling tampering and persistence.
• Disrupts service availability by killing the application, corrupting data, or using the host as a pivot into adjacent internal systems.