shiroiAdmin CVE-2026-15488

Q: What is the CVSS score of CVE-2026-15488?

CVE-2026-15488 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43210 MEDIUM

Improper Access Control (CWE-284)

2026-07-12 cna@vuldb.com

GHSA-6jr9-24jm-2547

PHP Authentication Bypass File Upload

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network upload of arbitrary PHP files in a web-accessible PHP app classically enables webshell RCE with full C/I/A impact and scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 09:30 vuln.today

DescriptionCVE.org

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issue. This patch is called 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in shiroiAdmin versions 1.1 and 1.3 (PHP admin panel by hcr707305003) exposes the FileController::upload function to unauthenticated remote exploitation, enabling attackers to upload arbitrary files - including PHP webshells - to the server without authentication. A public exploit has been disclosed (CVSS 4.0 E:P), and the vendor did not respond to coordinated disclosure. Exploitation conditions are severe: the CVSS 4.0 vector confirms network-accessible, zero-authentication, low-complexity exploitation with no user interaction required.

Technical ContextAI

shiroiAdmin is a PHP-based administrative panel framework hosted on GitHub. The vulnerability resides in the upload method of app/common/controller/FileController.php, which processes the user-controlled File argument without adequate type or extension validation. The root cause is classified as CWE-284 (Improper Access Control), meaning the upload function fails to enforce proper authorization and file-type restrictions before persisting user-supplied content to the server. The tags 'Authentication Bypass' and 'File Upload' indicate that the access control gate protecting the upload endpoint can itself be circumvented, making this a compound weakness: both the authentication layer and the file-type enforcement are defective. In PHP applications, unrestricted upload to a web-accessible path is a well-understood path to remote code execution via webshell.

RemediationAI

Upgrade to shiroiAdmin version 1.4 immediately; this release contains the remediation commit 3ecde28ea8a20a3840dbfefd6d6863ee79a83e70, available at https://github.com/hcr707305003/shiroiAdmin/commit/3ecde28ea8a20a3840dbfefd6d6863ee79a83e70. If an immediate upgrade is not possible, restrict network access to the upload endpoint at the web server or firewall level to trusted IP ranges only - this directly mitigates the unauthenticated network attack vector, though it does not fix the underlying flaw. Additionally, configure the web server to deny execution of scripts (PHP, CGI) within the upload destination directory; this breaks the webshell execution chain even if a malicious file is successfully uploaded. Note that the vendor did not respond to disclosure, so no official workaround guidance exists - these compensating controls are based on vulnerability class behavior.