CVE-2014-5454: Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remo...

Security readout for executives and security teams

SAS Visual Analytics 6.4M1 had an image upload weakness that could let a logged-in user upload an executable file and potentially run code on the server. The issue is serious because it turns ordinary application access into possible system compromise, but the source bundle does not provide CVSS, patch details, or confirmed active exploitation. Exposure is likely limited to organizations running SAS Visual Analytics 6.4M1 with the image upload module available to authenticated users. Risk increases where broad user groups, contractors, or federated identities can upload images. The provided sources do not name other SAS products or versions as affected. Prioritize remediation for any production SAS Visual Analytics 6.4M1 environment, especially where many users can authenticate. The business risk is server compromise from a valid account, which can bypass perimeter assumptions. If the product is retired or inaccessible, document that status and close the exposure trail. Mitigation focus: Check SAS vendor guidance for fixed versions or supported upgrade paths.; Restrict image upload access to trusted administrative users only.; Disable the image upload feature if it is not operationally required..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.