CVE-2026-16286 is an unrestricted file upload flaw in TRtek Software Repository Management, rated 9.8 (critical). The record says it allows a web shell to be uploaded to the web server, in builds before 2fb4acee. Contact the vendor for the fixed build, and restrict access in the meantime.
What's affected
- Product: Software Repository Management, from TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company.
- Affected: builds before 2fb4acee. The record gives this identifier instead of a version number, and it looks like a source revision.
- Fixed: a build at or after 2fb4acee. The record does not give a release number, so confirm the build with the vendor.
- Advisory: the record references a Turkish national advisory, TR-26-0899. It could not be loaded when this post was written, so check it directly.
- Severity: 9.8 with the record's CWE-434 (unrestricted upload of file with dangerous type). Not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Ask the vendor or your integrator which build you run, and compare it with 2fb4acee. If you manage the source, check the revision:
git log --oneline | grep 2fb4acee
Also look at the web server for unexpected script files in upload directories, and at upload logs for files with executable extensions. A web shell is a script the attacker can later request to run commands, so any new script file in a content or upload folder deserves a look.
What to do now
- Contact the vendor and ask for the fixed build, and the advisory TR-26-0899 details.
- Restrict access to upload features to authenticated, trusted users, and take the application off the public internet if you can.
- Configure the web server not to execute scripts from upload directories.
- Search upload folders for script files that you did not put there.
- If you find any, treat the server as compromised: isolate it, preserve logs, and rotate credentials.
Why it matters
CWE-434 describes software that accepts uploaded files without checking their type, and lets them land somewhere the web server will run them. A web shell is the worst case: the attacker uploads a small script, requests it, and gains the ability to run commands as the web server.
The score reflects that. No privileges, no user interaction and network access lead to full compromise of the server. The record does not say whether authentication is required for the upload, so assume the worst until the vendor says otherwise.
The safe design is well known. Allow only expected file types, check content as well as the name, store uploads outside the web root or in a location that does not execute scripts, and rename files on save.
Quick check
Is a version number available?
The record gives a build identifier, 2fb4acee, rather than a version. Ask the vendor how it maps to releases.
Is it being exploited?
The record is not on the CISA Known Exploited Vulnerabilities list and the record does not claim exploitation.
Sources
Last reviewed: 19 October 2026.
