We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X

Maximize Your Experience: Reap the Personalized Advantages by Completing Your Profile to Its Fullest. Update Here

Stay in the loop with the latest from Microchip. Update your profile while you are at it. Update Here

Complete your profile to access more resources. Update Here

PSIRT-137:TimePictra Platform Remote Code Execution via File Upload

Vulnerability Details

Date of Disclosure: 04/09/2026

Publication Date: 11/09/2026

Affected Product: Microchip TimePictra^® Platform

Vulnerability Type: Unrestricted upload of file with dangerous type (CWE-434)
CVE Identifier: CVE-2026-8331
CVSS Score: 8.8 (CVSS 4.0)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Description:
- An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution
Affected Versions: TimePictra platform versions before 12.0
Vulnerability Status: Resolved in TimePictra 12.0 platform

Risk Assessment

Successful exploitation could allow an authenticated, low-privileged attacker to upload a dangerous file and execute code, compromising the confidentiality, integrity and availability of the TimePictra platform and connected systems.

Mitigation

Upgrade to TimePictra 12.0 platform or later

Patch/Release Information

TimePictra 12.0 platform constrains file upload functionality and prevents dangerous file types from being uploaded and executed

Acknowledgements

Reported by Dario Emilio Bertani, Andrea Sindoni, Antonio Carriero, Marco Manieri, Vito Pistillo, Davide Renna, Renna Leone and Massimiliano Brolli of TIM Security Red Team Research

Recommendations

It is strongly recommend that all customers upgrade to the TimePictra 12.0 platform or later.