Arbitrary File Upload Enables Remote Code Execution in Sunnet CTMS/CPAS

CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7490 represents a critical arbitrary file upload vulnerability in Sunnet's Clinical Trial Management System (CTMS) and Clinical Pharmacy Automation System (CPAS). This CWE-434 vulnerability allows privileged remote attackers to bypass file upload restrictions and execute malicious web shells on vulnerable servers, granting them complete arbitrary code execution capabilities. Organizations deploying these systems for healthcare or clinical operations face immediate risk of system compromise, data exfiltration, and operational disruption. The high CVSS score of 7.2 reflects the severity of remote code execution combined with the requirement for privileged access, making this particularly dangerous for insider threats or compromised administrative accounts.

Casky.ai's 419 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's initial access (TA0001), command and control (TA0043), and execution (TA0002) phases. Practitioners using Casky would observe detection patterns for: file upload anomalies that bypass extension validation and MIME-type checks (TA0001 - Initial Access), suspicious web shell artifacts and script execution in upload directories (TA0002 - Execution), and outbound command and control communications from web server processes (TA0043 - Command and Control). The platform's skill correlation with extended reasoning would help security teams identify the complete attack chain—from the initial unauthorized file upload through shell execution—enabling faster incident response and threat hunting across their CTMS/CPAS infrastructure.

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7490.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-7490 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn