How to fix CVE-2025-15426?

Within 7 days: Identify all affected systems running jackying H-ui.admin and apply vendor patches promptly. Monitor vendor channels for patch availability.

Is PHP affected by CVE-2025-15426?

Organizations using jackying H-ui.admin face moderate risk from CVE-2025-15426, a improper access control vulnerability rated CVSS 7.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available, increasing the risk of exploitation.

CVE-2025-15426

HIGH

2026-01-02 [email protected]

PHP

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 02, 2026 - 16:45 vuln.today

Public exploit code

CVE Published

Jan 02, 2026 - 04:15 nvd

HIGH 7.3

DescriptionNVD

A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A vulnerability was identified in jackying H-ui.admin versions up to 3.1. is affected by improper access control (CVSS 7.3).

Technical ContextAI

This vulnerability (CWE-284: Improper Access Control) affects A vulnerability was identified in jackying H-ui.admin. was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected ProductsAI

Product: A vulnerability was identified in jackying H-ui.admin. Versions: up to 3.1..

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-15426 vulnerability details – vuln.today

Back