CVE-2026-11839: Arbitrary File Upload in Basarsoft's Rotaban

Synopsis

An unrestricted file upload vulnerability in Basarsoft's Rotaban allows an authenticated attacker to upload a web shell directly to the web server. The attack is reachable over the network, requires only a low-privilege account, and needs no victim interaction. Successful exploitation gives the attacker full read access to confidential data, the ability to modify or delete files and data, and the ability to disrupt or take over the service; with a Changed scope, impact extends beyond the vulnerable component itself. A patched-image rebuild at V2026.06.003 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Rotaban web application over the network; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrative or elevated credentials to reach the upload endpoint.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely on their own against the server-side endpoint.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Attacker uploads and executes a web shell, gaining remote code execution on the web server host.
• Attacker reads files accessible to the web server process, including configuration files, credentials, and stored application data.
• Attacker modifies or deletes application files, database records, or other persisted data reachable from the compromised server context.
• Because the CVSS scope is Changed, attacker activity can pivot beyond the Rotaban component itself to other services and resources sharing the same host or network segment.