{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.0"}],"component":"notrinos/notrinos-erp","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qv4m-m73m-8hj7","id":"tcs_01M5KF7KQ1SPZVJ92AGAET8DGK","modified_at":"2026-07-10T19:45:18.471313682Z","published_at":"2026-07-10T19:34:03Z","references":["https://osv.dev/vulnerability/GHSA-qv4m-m73m-8hj7","https://github.com/notrinos/NotrinosERP/security/advisories/GHSA-qv4m-m73m-8hj7","https://github.com/notrinos/NotrinosERP"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-qv4m-m73m-8hj7","url":"https://osv.dev/vulnerability/GHSA-qv4m-m73m-8hj7"}],"summary":"NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee \"Documents\" (doc_file)"}