EUVD-2026-41744
GHSA-cvqg-vphp-rf28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication required (PR:N per 4.0 vector); unrestricted file write warrants I:H; C:L and A:L pending confirmation of code execution path.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
AnalysisAI
Unrestricted file upload in Ruijie RG-UAC unified access controller appliances (all versions through 1.0-R1.8.2.p5) allows unauthenticated remote attackers to upload arbitrary files via the upload_image parameter in user_auth_commit.php. The combination of an authentication bypass (CWE-284) and unrestricted file type acceptance creates a pathway to persistent server-side code execution if uploaded content reaches an executable web path. A public proof-of-concept exploit exists, elevating the urgency of remediation despite the absence of a CISA KEV listing.
Technical ContextAI
The affected component is user_auth_commit.php, a PHP script in the RG-UAC web management interface that handles user authentication commit operations. The upload_image parameter in this endpoint accepts file uploads without enforcing file-type restrictions or validating that the requester is authenticated - a failure classified under CWE-284 (Improper Access Control). The RG-UAC (Unified Access Controller) is a network access control appliance by Ruijie Networks running a PHP-based web management stack. Because the application runtime is PHP, uploading a .php file to a web-accessible directory would result in server-side code execution upon HTTP retrieval. The lack of authentication on this specific endpoint is the primary access control gap; it is distinct from but compounded by the missing file-type validation.
RemediationAI
No vendor-released patch or explicit fix version is identified in the available reference data - affected versions extend through 1.0-R1.8.2.p5 with no successor version confirmed. Administrators should contact Ruijie Networks support directly for firmware update availability. As immediate compensating controls: restrict network access to the RG-UAC web management interface to trusted administrative subnets only (firewall/ACL), which removes the network-accessible attack surface at the cost of remote management convenience. If the web management interface must remain reachable, configure a reverse proxy or WAF rule to block POST requests to user_auth_commit.php that include multipart file upload bodies, accepting the trade-off that legitimate image upload functionality on this endpoint will be disrupted. Disable the upload_image functionality at the application level if Ruijie provides a configuration toggle. Monitor web server logs for unexpected files appearing in web-accessible directories. Reference the VulDB entry at https://vuldb.com/vuln/376318 for any vendor response updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today