BorG Technology Corporation Borg SPM 2007 Arbitrary File Upload Vulnerability Allowing Remote Code Execution

An arbitrary file upload vulnerability has been identified in Borg SPM 2007, a product developed by BorG Technology Corporation that is no longer sold. This vulnerability allows unauthenticated remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Borg SPM 2007 is installed.

Remediation

Customers with active maintenance contracts are advised to contact the vendor for patching assistance or to upgrade to the latest version, as SPM2025 SP1 has successfully passed source code security audits.