CVE-2026-91844 is an unrestricted file upload flaw in Eimzamip from Izometri IT Services, from version 1.6.4 up to but not including 1.6.6. NVD scores it High (7.3). Upgrade to 1.6.6 or later and read the national cyber security notice for details.
What's affected
The NVD record says the issue affects Eimzamip from v1.6.4 before v1.6.6, which makes 1.6.6 the first version outside the range. The weakness is CWE-434, unrestricted upload of a file with a dangerous type.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N: reachable over the network, a login required, and a user action needed, with high impact on confidentiality and integrity.
The only reference is a notice from the Turkish national cyber security authority (tr-26-1275). Its page did not return readable text in our fetch, so we have not confirmed more than the record says. Read the notice for any workaround and confirm the fixed version with the vendor.
How to check if you're exposed
Find the Eimzamip version you run, in the application's settings or from your deployment records. Anything from 1.6.4 up to but not including 1.6.6 is affected.
Then look at how uploads are handled. Check which accounts can upload files, which file types the application stores, and whether uploaded files are saved in a location the web server can execute or serve directly. Review the upload folder for files with unexpected extensions, such as scripts or executables.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade Eimzamip to 1.6.6 or later after confirming with the vendor or the national notice.
- Make sure uploaded files are stored outside the web root, or in a location configured never to execute content.
- Allow only the file types the application needs, and check content as well as extension.
- Review upload folders and logs for files that should not be there.
- Limit which accounts can upload.
Why it matters
Unrestricted file upload is dangerous because it lets someone put their own content onto your server. If the application does not limit which types it accepts, or serves uploaded files from a place where they can run, an uploaded file can turn into code execution or be used to attack other users who open it. The record describes using malicious files, which is the general form of the risk.
The vector says a login and a user action are involved, which lowers the likelihood compared with a wide open endpoint. The result is still a high impact score, because uploaded content can carry real weight. The KEV flag in the record is false and no source we could read reports exploitation.
Quick check
Which version is fixed?
The record places the flaw in 1.6.4 before 1.6.6, so 1.6.6 is the first version outside it. Confirm with the vendor.
Does the attacker need an account?
The vector shows low privileges are required, plus a user interaction.
Sources
Last reviewed: 18 October 2026.
