External risk intelligence

vsDesk CSV Import Arbitrary File Upload Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-2334

The vulnerability affects vsDesk, which is commonly deployed as an internet-facing service desk web application. While the attack requires administrative privileges, the application itself is typically accessible from the internet to allow remote users and technicians to access the help desk portal, placing the administrative interface within reach of the public network.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability discovered in vsDesk, a web application. An attacker with administrative access could exploit this by uploading arbitrary files, potentially leading to remote code execution. The main concern is confirming the relevance and exposure of this technology within your environment.

Attacker bypasses file uploads via CSV import.
Critical risk if administrative access is compromised.
Confirm relevance and exposure of vsDesk.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access could bypass client-side checks in the "Import via CSV" feature to upload arbitrary files. This is possible because the application fails to perform adequate server-side validation of uploaded files. If successful, this could lead to the execution of malicious code on the server within the web application's context.

Requires administrative privileges.
Upload arbitrary file via CSV import.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated administrator could upload arbitrary files by bypassing client-side validation. This may lead to remote code execution if server-side validation is also missing, impacting the web application's integrity and behavior.

Web application code and configuration.
Upload arbitrary files via the import feature.
Remote code execution affecting service availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The "Import via CSV" component in vsDesk is vulnerable to arbitrary file uploads due to insufficient server-side validation, potentially leading to remote code execution. This critical vulnerability requires immediate attention from teams responsible for the application and its underlying infrastructure. The first practical step is to identify all instances of the affected technology, assess their exposure and business criticality, and then confirm the accountable owner before planning remediation.

Application owners should investigate current deployments.
Verify instances reachable from the internet.
Plan coordinated updates with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is vsDesk?

vsDesk is a service desk web application used by organizations to manage IT support, help desk ticketing, and internal service requests. It is typically deployed as a centralized portal where technicians and users interact to resolve operational issues.

What does CVE-2026-2334 mean?

This vulnerability is an Unrestricted Upload of File with Dangerous Type, classified as CWE-434. In simple terms, the application fails to verify the contents of files uploaded through its CSV import tool. Because the server does not enforce security checks, an attacker can upload malicious files instead of standard data, potentially gaining the ability to run arbitrary code on the server.

How does an attacker trigger this vulnerability?

The attack requires access to the application's administrative interface. An attacker must use the 'Import via CSV' feature to upload a file designed to bypass client-side checks. Simply using the application for normal tasks or having standard user access does not trigger this flaw; it specifically requires high-level privileges to interact with the file import component.

Is my vsDesk instance at risk?

Halo Surface Signal indicates that vsDesk is often deployed as an internet-facing portal. If your administrative interface is reachable from the public network, it faces a higher level of risk. You should determine if your deployment is accessible online, as this increases the likelihood of unauthorized administrative access being exploited.

How do I respond to this threat?

Your first step is to locate all active deployments of vsDesk within your environment and confirm who is responsible for their maintenance. Once identified, evaluate their network exposure. Finally, coordinate with your team to update the software to version 14.0402 or later, which contains the necessary patch to enforce proper file validation.

References

vsdesk.ru/news/vyshla-novaya-versiya-140422

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.