EUVD-2026-46137
GHSA-2hmw-28mw-95rf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network upload of a PHP webshell yields OS-level RCE with scope change to underlying OS, warranting PR:N, S:C, and full C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the /web/jquery/uploader/uploadify.php endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Technical ContextAI
The D-Link DNS-320 is a consumer and SOHO Network Attached Storage device running an embedded Linux environment with a PHP-based web management interface. The vulnerable component is /web/jquery/uploader/uploadify.php, a PHP wrapper around the jQuery Uploadify file upload library - a third-party component historically used in web applications to facilitate multi-file upload operations. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates the script fails to enforce any meaningful validation on the file type, extension, MIME type, or content of uploaded files. This allows an attacker to upload a PHP webshell or other executable script to a web-accessible directory; once uploaded, a simple HTTP GET request to the file path triggers server-side execution with the web server process's privileges. The CPE cpe:2.3:a:d-link:dns-320:*:*:*:*:*:*:*:* applies broadly to the DNS-320 product line, with firmware 1.0.2 specifically cited in the disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the DNS-320 is a legacy SOHO NAS device with probable end-of-life status, making a firmware update from D-Link unlikely. The primary recommended action is to immediately remove the DNS-320 web management interface from any public internet exposure by placing the device behind a firewall with inbound HTTP and HTTPS access restricted to trusted IP ranges only. As a specific compensating control, block all requests to the path /web/jquery/uploader/uploadify.php at the network perimeter or via any available device ACL; note this does not address other potential vulnerabilities in the aging firmware. If the web management interface is not operationally required, disable it entirely where the device firmware permits. Long-term, replacement of the DNS-320 with an actively supported and patched NAS device is the only fully remediated path. Monitor https://www.dlink.com/ for any future security advisories. The researcher's PoC documentation is hosted at the Feishu reference linked in the CVE, which should be reviewed by defenders to understand exact exploit mechanics.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today