EUVD-2026-54982
GHSA-29wf-fqv4-q567
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
shell_exec on attacker-uploaded content yields OS-level code execution (Scope:Changed, C/H/I/H/A:H); PR:H reflects mandatory admin authentication per CVSS vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product is published by multiple vendors.
AnalysisAI
Unrestricted file upload via shell_exec in SaiAdmin up to version 5.0.1 exposes the Plugin Upload Endpoint (/app/saipackage/install/upload) to potential remote code execution by authenticated high-privilege users. The affected function passes uploaded plugin content through shell_exec without adequate file-type validation, a pattern consistent with CWE-434 that typically enables server-side code execution beyond simple file storage. A proof-of-concept exploit has been publicly disclosed on GitHub (CVE-2026-19383 issue), raising the operational risk above what the conservative VulDB-assigned CVSS 4.0 score of 5.1 might suggest; no vendor patch has been identified at time of analysis.
Technical ContextAI
SaiAdmin is a PHP-based administration panel published under both the saithink and saigroup vendor namespaces (CPE: cpe:2.3:a:saithink:saiadmin:*:*:*:*:*:*:*:* and cpe:2.3:a:saigroup:saiadmin:*:*:*:*:*:*:*:*). The vulnerability resides in the plugin installation workflow, specifically the file upload handler at /app/saipackage/install/upload, which invokes PHP's shell_exec() function against user-supplied input or uploaded content without sufficient restriction on allowable file types. CWE-434 (Unrestricted Upload of File with Dangerous Type) captures the root cause: the application fails to enforce an allowlist of safe file extensions or MIME types before persisting or processing the upload. The combination of shell_exec() with an unrestricted upload endpoint is a classic web-shell or command-injection pattern - an attacker may upload a PHP script or archive containing executable payloads that the server subsequently processes.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vulnerability remains unmitigated at the package level. As an immediate compensating control, restrict network access to the Plugin Upload Endpoint (/app/saipackage/install/upload) at the web server or firewall layer - allow access only from trusted management IP ranges, accepting the trade-off that legitimate remote plugin installations will be blocked. Where possible, disable the plugin installation feature entirely if it is not operationally required, reducing the attack surface permanently. Audit all previously uploaded plugins for unexpected files with executable extensions (.php, .sh, .py, .phar) or unexpected shell content. Enforce strong, unique credentials for any administrative account with plugin management rights, and apply multi-factor authentication if the application supports it. Monitor the upload directory and web server logs for anomalous file creation or shell_exec invocations. Consult VulDB advisory https://vuldb.com/vuln/387276 for vendor communications and patch announcements.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today