title: Cybonet  - PineApp
description: PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a malicious file,Thus taking over the server and running remote code.
problem types: Authenticated RCE
affected:
{
product: PineApp - Mail Secure
vendor: Cybonet
versions:
status: affected, version: PineApp - Mail Secure Latest
}
solutions: Code hardening by limiting the upload file to only limited images file types