Multiple vulnerabilities in the installer for Pupsman

CSIRTS triage

What

The installer for Pupsman contains multiple vulnerabilities.

Who is affected

Deployments of the Pupsman installer.

Urgency

Remediation is necessary due to the presence of multiple vulnerabilities, though severity is unknown.

Action

Update the installer for Pupsman to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

JVN (Japan Vulnerability Notes) (JP · national-cert · site)

Severity

unknown

Published

2026-07-08

Exploitation

Not in CISA KEV at last sync

Original advisory: https://jvn.jp/en/jp/JVN62347140/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-564370.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
• Low exploitation riskCVE-2026-578950.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• highCVE-2026-57895: Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can…nvd
• highCVE-2026-56437: Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted…nvd

Recent advisories for installer for Pupsman

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-57895: Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can…nvd · 2026-07-08
• highCVE-2026-56437: Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted…nvd · 2026-07-08

More from JVN (Japan Vulnerability Notes)

• unknownReflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Ima…2026-07-09
• unknownApache Jena Fuseki vulnerable to path traversal2026-07-07
• unknownSEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery2026-07-07
• unknownSeiko Solutions SkyBridge MB-A100/MB-A110 vulnerable to OS command injection2026-07-01
• unknownRPG MAKER MV and MZ vulnerable to OS command injection2026-06-30