CVE-2026-18969: Rongzhitong Command Platform RCE Flaw

CVE-2026-18969 Overview

CVE-2026-18969 is an unrestricted file upload vulnerability in the Rongzhitong Visual Integrated Command and Dispatch Platform through version 20260617. The flaw resides in an unknown function of the /dm/dispatch/userinfo/upload endpoint. Manipulation of the File argument allows an attacker to upload arbitrary files without restriction. The issue is remotely exploitable and requires no authentication or user interaction. Public exploit details have been released, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Remote attackers can upload arbitrary files to the dispatch platform without authentication, enabling potential web shell deployment and follow-on code execution against the affected host.

Affected Products

Rongzhitong Visual Integrated Command and Dispatch Platform versions up to and including 20260617
Endpoint affected: /dm/dispatch/userinfo/upload
Parameter affected: File

Discovery Timeline

2026-08-06 - CVE-2026-18969 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database
Vendor was contacted prior to disclosure but did not respond

Technical Details for CVE-2026-18969

Vulnerability Analysis

The Rongzhitong Visual Integrated Command and Dispatch Platform exposes an HTTP upload handler at /dm/dispatch/userinfo/upload. This handler processes the File parameter without enforcing restrictions on file type, extension, MIME type, or content. An attacker can submit a crafted multipart request and place arbitrary content into a location served by the application.

The published exploit details indicate the attack is reachable over the network with no privileges required. Because the platform is designed for command and dispatch operations, unauthorized file placement can compromise the confidentiality, integrity, and availability of dispatch data and downstream systems.

Root Cause

The root cause is missing access control and missing validation on the upload endpoint. The application accepts the File argument without verifying the requester's identity, without validating the uploaded content, and without constraining the destination path. This maps to CWE-284: Improper Access Control and reflects a broader unrestricted upload weakness pattern.

Attack Vector

Exploitation requires only network access to the vulnerable endpoint. An attacker issues an HTTP POST request to /dm/dispatch/userinfo/upload containing a multipart form with the File field set to attacker-controlled content. If the upload location is reachable via HTTP, the attacker may retrieve the uploaded resource and, depending on server configuration, trigger execution of server-side code. The exploit is public per the VulDB entry for CVE-2026-18969, increasing the likelihood of opportunistic scanning.

No verified proof-of-concept code is republished here. Technical details are available in the VulDB vulnerability record and the Feishu Wiki resource.

Detection Methods for CVE-2026-18969

Indicators of Compromise

Unexpected HTTP POST requests to /dm/dispatch/userinfo/upload from external or unusual internal source addresses
New files with server-executable extensions (.jsp, .jspx, .war, .aspx, .php) appearing in upload directories of the dispatch platform
Web server processes spawning shell, cmd.exe, or scripting interpreters shortly after upload requests
Outbound connections initiated by the dispatch platform host to unfamiliar external hosts following upload activity

Detection Strategies

Alert on HTTP requests to /dm/dispatch/userinfo/upload where the File parameter contains executable or archive extensions
Baseline the expected file types written to upload directories and flag deviations
Correlate upload events with subsequent process creation on the web server to identify web shell execution
Inspect web access logs for repeated upload attempts from a single source, which suggest automated exploitation

Monitoring Recommendations

Forward web server access logs and file integrity monitoring events to a centralized analytics platform for correlation
Monitor upload directories for write operations outside of scheduled application workflows
Track outbound network traffic from the dispatch server to identify command-and-control activity following successful uploads

How to Mitigate CVE-2026-18969

Immediate Actions Required

Restrict network access to the /dm/dispatch/userinfo/upload endpoint using firewall rules or a reverse proxy allowlist until a vendor fix is available
Place the dispatch platform behind an authenticating gateway and require session validation before requests reach the upload handler
Review upload directories for unauthorized files and remove any artifacts that do not match legitimate application data
Rotate credentials, tokens, and keys stored on the affected host if evidence of upload abuse is found

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to the disclosure. Administrators should track the VulDB CVE-2026-18969 entry for updates and apply vendor guidance as soon as it is released.

Workarounds

Block external access to /dm/dispatch/userinfo/upload at the web application firewall (WAF) and permit only known internal source addresses
Enforce server-side extension and MIME-type allowlisting on the upload path, rejecting any executable content
Configure the upload directory as non-executable at the web server level so that uploaded files cannot be interpreted as server-side scripts
Require authenticated sessions on all /dm/dispatch/* routes via reverse proxy authentication

bash

# Example NGINX reverse-proxy hardening for the vulnerable endpoint
location = /dm/dispatch/userinfo/upload {
    # Restrict to trusted internal ranges only
    allow 10.0.0.0/8;
    deny all;

    # Require upstream authentication
    auth_request /auth;

    # Reject non-multipart uploads and cap size
    if ($content_type !~* "multipart/form-data") { return 415; }
    client_max_body_size 5m;

    proxy_pass http://dispatch_backend;
}

# Ensure the upload directory cannot execute server-side code
location ^~ /uploads/ {
    default_type application/octet-stream;
    types { }
}