---
id: CVE-2026-111793
title: >-
  Openwave Webtop Media Transcoder does not enforce administrator-defined file
  type restrictions to restrict the file-types to be converted
summary: >-
  Openwave Webtop Media Transcoder does not enforce administrator-defined file
  type restrictions to restrict the file-types to be converted. This may allow
  an authenticated user to process and convert unintended document types if
  bypassing…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-669
vendor: Openwave Messaging (Ireland) Limited
product: Webtop Media Transcoder
affected:
  - webtop_media_transcoder < 1.1.22.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:28:10.170Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111793'
references:
  - url: 'https://openwave.ai'
  - url: >-
      https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.622Z'
---

## Overview

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

## Affected

- `webtop_media_transcoder < 1.1.22.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.