CVE-2026-48939 · High · CISA KEV

iCagenda Unrestricted File Upload: Critical for Web Servers Handling User Content

Threat Engine Auto-Feed · data current as of 2026-07-10

CVE-2026-48939 in iCagenda allows unrestricted file uploads, enabling attackers to execute arbitrary PHP code. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA KEV, posing a significant risk to affected web environments.

  • CVSS:
  • EPSS percentile: 0.42883
  • Exploitation pressure: 51/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 43th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is an 'unrestricted upload of file with dangerous type' issue. It means that the software does not properly validate or restrict the types of files that users can upload. An attacker can exploit this by uploading a file that contains malicious code (like a PHP script) instead of a legitimate file, which the server then executes.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using iCagenda for event management or content delivery
  • Any enterprise hosting web applications that allow user-uploaded content without stringent validation
  • Financial services and Technology sectors, due to documented targeting by relevant threat actors

Misconfigurations that escalate it

  • Web servers configured to execute scripts from user-upload directories
  • Lack of robust input validation and file type/content checking on user uploads
  • Insufficient permissions separation between web content and user-uploaded files

High-impact scenarios

  • Remote code execution on the web server, leading to full system compromise
  • Data theft or manipulation from the compromised server and connected databases
  • Establishment of persistent access for further network penetration or ransomware deployment
  • Web defacement or use of the compromised server for hosting malicious content

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor web server logs for unusual file uploads, especially of executable or script file types (e.g., .php, .asp, .jsp) in user-upload directories.
  • Implement file integrity monitoring (FIM) on web server directories to detect unauthorized file changes or additions.
  • Look for unexpected outbound connections from the web server that could indicate command-and-control activity.

Contain

  • Isolate affected iCagenda instances from the network to prevent further compromise.
  • Disable or restrict write permissions to user-upload directories on the web server.
  • Review and revoke any unauthorized user accounts or changes made post-compromise.

Patch

  • Apply the latest security patches or updates for iCagenda as soon as they become available.
  • If a patch is not immediately available, consider implementing web application firewall (WAF) rules to block uploads of dangerous file types.

Frontier verdict — High

This is a high-priority vulnerability due to active exploitation in the wild (CISA KEV) and the potential for remote code execution, impacting organizations with iCagenda deployments.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.