Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege

The installer for Pupsman provided by Fuji Electric Co.,Ltd. contains multiple vulnerabilities listed below:<ul><li>Uncontrolled search path element (CWE-427) - CVE-2026-56437</li><ul><li>The CVSS vectors above assume that a victim user is directed to place a specially crafted DLL file in the same folder as the affected installer and to execute the installer.</li></ul></ul><ul><li>Incorrect default permissions (CWE-276) - CVE-2026-57895</li></ul>Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.