Description
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.

This issue affects FM Systems Employee: before 2025.3.1.
Published: 2026-07-31
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 31 Jul 2026 18:15:00 +0000

Type Values Removed Values Added
Description Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.
Title FMS Employee Allows Upload of Unrestricted Files
First Time appeared Johnson Controls
Johnson Controls fm Systems Employee
Weaknesses CWE-434
CPEs cpe:2.3:a:johnson_controls:fm_systems_employee:*:*:*:*:*:*:*:*
Vendors & Products Johnson Controls
Johnson Controls fm Systems Employee
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Johnson Controls Fm Systems Employee
cve-icon MITRE

Status: PUBLISHED

Assigner: jci

Published:

Updated: 2026-07-31T18:24:41.723Z

Reserved: 2026-01-02T13:23:28.170Z

Link: CVE-2026-21662

cve-icon Vulnrichment

Updated: 2026-07-31T18:24:38.220Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses