CVE-2026-32867 OPEXUS eComplaint unauthenticated file upload
Unauthenticated attackers can upload arbitrary files to eComplaint cases by guessing case numbers, leading to data modification and potential storage exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-32867?
CVE-2026-32867 is a medium-severity vulnerability in OPEXUS eComplaint, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.
Which versions are affected by CVE-2026-32867?
It affects 1 product.
Products include Opexustech Ecase Ecomplaint.
How do I fix CVE-2026-32867?
No fix has been published for CVE-2026-32867 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32867 being exploited?
There is no known exploitation of CVE-2026-32867 in the wild and no public exploit code.
Other vulnerabilities in OPEXUS eComplaint
- CVE-2026-32865 OPEXUS eComplaint and eCase insecure password reset
- CVE-2026-22235 OPEXUS eComplaint IDOR
- CVE-2026-32866 OPEXUS eComplaint and eCase stored XSS via profile first and last name
- CVE-2026-32868 OPEXUS eComplaint and eCASE XSS via my information
- CVE-2026-32869 OPEXUS eComplaint and eCASE XSS via Name of Organization field
Sources
Also known as GHSA-qw9c-jpw9-vj74.