CVE-2019-10267: Ahsay Cloud Backup Suite unrestricted file upload leads to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw yields remote code execution as Administrator with public exploit code and very high EPSS, but it requires an authenticated account and is not in KEV.

What it is

Ahsay Cloud Backup Suite 8.1.0.50 allows an authenticated user to upload a file into any directory on the server. Because uploaded JSP files are executed by the web server, an attacker can place a shell and run code as the configured service account. This turns a backup application into a full remote code execution foothold on the host.

Impact

An attacker gains arbitrary code execution with the privileges of the web server's configured user, described as Administrator, giving full access to the system and any data or credentials it holds.

Attack surface

Reachable over the network through the application's file upload functionality; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so any authenticated account able to reach the upload feature is sufficient.

Exploitation

Public exploit code is referenced by multiple Packet Storm and third-party advisories, and EPSS is very high (0.75171, 99.5th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Ahsay Cloud Backup Suite to a version later than 8.1.0.50 that fixes the upload path handling; confirm the fixed build with the vendor.
• If patching is not immediately possible, restrict or disable the file upload feature and limit network access to the management interface to trusted hosts.
• Run the web service under a low-privilege account rather than Administrator, and remove execute permissions for uploaded content directories.
• Block execution of script files such as JSP in upload and web-accessible directories at the web server or reverse proxy.
• Audit the server for unexpected JSP or web shell files and review upload directories for unauthorized content.

Detection

• Monitor upload directories and web roots for newly created JSP or other executable script files.
• Alert on web server processes spawning command interpreters or unexpected child processes.
• Review web server and application logs for upload requests followed by requests to the uploaded file path.
• Baseline and monitor the configured service account for anomalous file writes or process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.