EUVD-2026-46321
GHSA-gm6p-5jmf-36cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires low-privilege auth (PR:L); impact limited to Low C/I with no confirmed server-side execution path from available data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Technical ContextAI
ZS-Admin is a Java-based administrative panel (CPE: cpe:2.3:a:zsadmin2025:zs-admin:*:*:*:*:*:*:*:*) distributed as a rolling release without discrete version tags. The vulnerable component is com.zs.file.controller.SysFileController, which handles the /api/system/file/upload HTTP endpoint. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the controller accepts the File argument without enforcing a whitelist of permitted MIME types or file extensions, allowing submission of executable scripts, archives, or other dangerous payloads. In Spring-based Java web applications, such a flaw can enable server-side webshell deployment if the upload directory is web-accessible and the application server executes uploaded content.
RemediationAI
No vendor-released patch has been identified at the time of analysis - the project was notified via a GitHub issue report but has not responded. As an immediate compensating control, administrators should restrict access to the /api/system/file/upload endpoint at the network or application gateway level, permitting only trusted internal IP ranges; this mitigates remote exploitation but does not address insider or compromised-credential scenarios. If the upload directory is web-accessible, removing execute permissions on that directory prevents server-side execution of uploaded files, though uploaded malicious content would still be stored. Implementing a MIME type and file extension whitelist in SysFileController - rejecting anything outside a known-safe set such as images or documents - is the recommended code-level fix. Organizations should monitor the upstream repository at https://github.com/zsadmin2025/zs-admin-java and the VulDB tracking page https://vuldb.com/vuln/380830 for a patch release. If the application is non-essential, consider taking it offline until a fix is available.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listi
SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderFie
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today