MediumCVSS4.32026-11-11
CVE-2026-111793 — Openwave Webtop Media Transcoder file-type restriction bypass: explainer and fix (fixed in 1.1.22.0, attacks observed, listed in KEV)
A flaw (CWE-669) in Openwave Messaging's Webtop Media Transcoder before 1.1.22.0. The vendor advisory says administrator-defined file-type restrictions are not enforced, so an authenticated user who bypasses the Webmail interface can convert unintended document types. The vendor's CVSS is 4.3, but JVN says the developer has observed attacks and describes the impact as obtaining information, so the sources differ. Added to CISA KEV on 10 November (due 24 November). This site's view: despite the low score, attacks and a KEV listing mean messaging operators should check versions and apply the fix.