CVE-2026-111793

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-19
Weakness: CWE-669

Description

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

Affected products

Openwave Messaging (Ireland) Limited Webtop Media Transcoder: before 1.1.22.0 — fixed in 1.1.22.0

How to fix

Upgrade to a fixed version: Openwave Messaging (Ireland) Limited Webtop Media Transcoder 1.1.22.0. Check the vendor advisory for mitigations.

References

https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md
https://openwave.ai

Get alerted when CVE-2026-111793 or the next vulnerability affects your stack