Hi,

The following vulnerabilities were published for ocsinventory-server.

CVE-2026-76174[0]:
| Unrestricted file upload vulnerability in the CSV file upload
| functionality of the Ocsreports admin_info endpoint. The application
| validates files solely based on the name provided by the client,
| without properly checking their content or securely restricting the
| permitted file types. This allows a user with administrator
| privileges to upload PHP files to a directory accessible via the web
| interface. If the file is subsequently processed by the server, an
| attacker could execute arbitrary code with the privileges of the
| account used by the web service.


CVE-2026-76175[1]:
| SQL injection vulnerability in the del_check parameter of the
| /ocsreports/?function=save_query_list endpoint. Input provided by an
| authenticated user with operator privileges is incorporated into an
| SQL query without proper parameterisation or validation, allowing
| the query to be manipulated and information to be extracted from the
| database using SQL injection techniques.


CVE-2026-76176[2]:
| SQL injection vulnerability in the endpoint
| /ocsreports/index.php?function=admin_double due to improper
| processing of the values in the ID field included in the
| selected_grp_dupli[] parameter. An authenticated user with operator
| privileges can manipulate these values to alter the SQL queries
| executed by the application and retrieve information stored in the
| database.


CVE-2026-76177[3]:
| Server-Side Request Forgery (SSRF) vulnerability in the
| /ocsreports/?function=tele_activate endpoint due to insufficient
| validation of the HTTPS_SERV and FILE_SERV parameters. An
| authenticated user with operator privileges can provide arbitrary
| values for these parameters, causing the OCS Inventory server to
| make HTTP/HTTPS requests to external systems or internal resources,
| which could allow access to internal network services or metadata
| resources of cloud services.


CVE-2026-76178[4]:
| A stored Cross-Site Scripting (XSS) vulnerability in the
| notification template functionality of the endpoint
| /ocsreports/?function=notification. A user with administrator
| privileges can input malicious HTML content which is subsequently
| stored and displayed without proper sanitisation when other
| administrators access the template customisation view, allowing
| JavaScript code to be executed within the application’s security
| context and potentially compromising the sessions of other users
| with administrative privileges.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-76174
https://www.cve.org/CVERecord?id=CVE-2026-76174
[1] https://security-tracker.debian.org/tracker/CVE-2026-76175
https://www.cve.org/CVERecord?id=CVE-2026-76175
[2] https://security-tracker.debian.org/tracker/CVE-2026-76176
https://www.cve.org/CVERecord?id=CVE-2026-76176
[3] https://security-tracker.debian.org/tracker/CVE-2026-76177
https://www.cve.org/CVERecord?id=CVE-2026-76177
[4] https://security-tracker.debian.org/tracker/CVE-2026-76178
https://www.cve.org/CVERecord?id=CVE-2026-76178

Regards,
Salvatore