Attackers exploit Openwave Webtop file restriction flaw

JPCERT/CC has warned that attackers are exploiting CVE-2026-111793 in the Openwave Webtop Media Transcoder, with the advisory noting that attacks observed by the developer are underway. The vulnerability affects Openwave Webtop versions prior to 1.1.22.0, and Openwave recommends upgrading to 1.1.22.0 or later, or moving to a supported Media Server 2.0 release. The issue has been described as exploited in the wild, with an EPSS of 0.2% (30 days) and a CVSS v3 score of 4.3 (Medium). The Webtop Media Transcoder is part of Openwave’s Webtop webmail platform used by service providers.

The flaw arises because the transcoder does not enforce administrator-defined file type restrictions, allowing an authenticated user to route files that administrators intended to block straight to the converter. Openwave’s public notes indicate that a logged‑in user can bypass the Webmail experience to submit unexpected document types for transcoding, potentially enabling information disclosure. JPCERT/CC classifies the root cause as CWE-669 (Incorrect Resource Transfer).

The affected versions are Webtop Media Transcoder prior to 1.1.22.0. Mitigation steps stated by Openwave are to upgrade to 1.1.22.0 or later or to move to the latest Media Server 2.0 supported release; they also advise contacting Openwave for patch details.