Hyland vulnerabilities
We track 9 vulnerabilities in Hyland products across 12 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Hyland vulnerabilities
- 7.8 High severity
Desktop Host: Incorrect Default Permissions
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate priv
- 9.8 Critical severity
PACSgear MediaWriter: Missing Authentication for Critical Functionality
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalli
- 9.8 Critical severity
PACSgear PACS Scan: Missing Authentication for Critical Functionality
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authen
- 9.8 Critical severity
Alfresco Transformation Service (Enterprise): Server-Side Request Forgery
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
- 9.8 Critical severity
Alfresco Transformation Service (Enterprise): Server-Side Request Forgery
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.
- 8.2 High severity
Alfresco Transformation Service (Enterprise): Absolute Path Traversal
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.
- 7.5 High severity
Alfresco Enterprise: Incorrect Authorization
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
- 9.8 Critical severity
OnBase Workflow Timer Service: Deserialization of Untrusted Data
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8
- 8.8 High severity
Alfresco Content Services: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to