CVE-2026-111793 is a medium-severity vulnerability. Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file types to be converted. This may allow an authenticated user to process and convert unintended document types by bypassing the Webmail experience.

This vulnerability affects Openwave Messaging (Ireland) Limited Webtop Media Transcoder.

Affected versions: Webtop Media Transcoder versions earlier than 1.1.22.0 are affected.

Webtop Media Transcoder does not properly enforce administrator-defined file type restrictions. An authenticated user may bypass the Webmail interface and submit unsupported or restricted document types directly to the transcoder service for processing.

Step 1 - Authenticate to the System

The attacker logs in with a valid user account to the affected Openwave messaging environment.

Step 2 - Bypass the Webmail Interface

Instead of using the standard Webmail interface, the attacker sends requests directly to the backend media transcoder service.

Step 3 - Submit Restricted File Types

The attacker submits file types that administrators intended to block through configured file-type restrictions.

Step 4 - Unauthorized File Processing

The transcoder processes and converts the restricted files because server-side validation is not properly enforced.

CERTVU recommends the following:

1. Upgrade Immediately

   Upgrade Webtop Media Transcoder to version 1.1.22.0 or later.

2. Restrict Access

   Limit access to media transcoding services to trusted and authorized users only.

3. Implement Server-Side Validation

   Ensure file type restrictions are enforced on the server side rather than relying solely on the Webmail interface.

4. Review Access Controls

   Periodically review user permissions and restrict access to the media conversion functionality where not required.