CVE-2026-1331

The attacker sends an HTTP request containing a malicious file (e.g., web shell) to the vulnerable MeetingHub application endpoint without needing to have an account or session. The application does not properly validate the type or content of the uploaded file, resulting in the file being saved to a location accessible by the web server. The attacker then invokes the uploaded file through a browser or HTTP request, resulting in arbitrary code execution on the server side.

Attacker gains the ability to execute arbitrary code on the server (RCE) with the privileges of the web server process, which may lead to full system compromise, data theft, installation of additional malware, or further lateral movement in the network.

Patches available from the vendor should be applied in accordance with references published by TWCERT at https://www.twcert.org.tw/en/cp-139-10651-ff09c-2.html and https://www.twcert.org.tw/tw/cp-132-10650-a5ee9-1.html. Until the patch is installed, it is recommended to restrict access to file upload functionality at the firewall or reverse proxy level and monitor server directories for new, unauthorized executable files.

Hamastar MeetingHub Paperless Meetings product — versions indicated in vendor references (TWCERT)