What is the CVSS score of CVE-2026-30761?

CVE-2026-30761 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of SourceBans Material Admin are affected by CVE-2026-30761?

SourceBans Material Admin v1.1.6 contains a critical remote code execution vulnerability in the file upload function, with publicly available exploit code existing for this vulnerability.

How to fix or mitigate CVE-2026-30761?

24 hours: Identify all instances of SourceBans Material Admin v1.1.6 in your environment and restrict network access to the admin upload endpoint (pages/admin.uploadmapimg.php) via firewall or network segmentation. 7 days: Deploy WAF rules to block file uploads with PHP extensions or suspicious MIME types to the affected endpoint. 30 days: Migrate to a patched version (monitor SourceBans releases for v1.1.7 or later) or transition to an alternative admin panel with active security maintenance.

SourceBans Material Admin CVE-2026-30761

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-28 mitre

File Upload RCE PHP N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:27 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

7.3 (HIGH)

CVE Published

May 28, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary code via uploading a crafted image file.

AnalysisAI

Arbitrary file upload in SourceBans Material Admin v1.1.6 allows remote unauthenticated attackers to achieve code execution by uploading a crafted image file to the pages/admin.uploadmapimg.php endpoint. The flaw is tagged as a PHP RCE vector and has public proof-of-concept gists referenced on GitHub, though it is not listed in CISA KEV and carries a very low EPSS exploitation probability (0.02%, 5th percentile).

Technical ContextAI

SourceBans Material Admin is a PHP-based web administration interface (a Material design fork of SourceBans, commonly used to manage Source-engine game server bans). The vulnerable component pages/admin.uploadmapimg.php is intended to handle map image uploads for the admin panel. The root cause class is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the application fails to adequately validate file content, extension, or MIME type before storing the file in a web-accessible directory, allowing a polyglot or disguised PHP payload to be executed by the server. Note that the provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and does not authoritatively bind the CVE to a vendor/product entry in the NVD dictionary.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis; the upstream tracker issue https://github.com/SB-MaterialAdmin/Web/issues/374 should be monitored for a tagged release that supersedes v1.1.6, and operators should upgrade to that fixed version as soon as it is published. As compensating controls, restrict access to the /pages/admin.uploadmapimg.php endpoint via web-server rules (for example, an nginx or Apache location block requiring an IP allowlist or a reverse-proxy authentication layer in front of the admin panel) - the trade-off is that legitimate admins must connect from approved networks or via VPN. Additionally, configure the web server to refuse PHP execution within the map-image upload directory (e.g., a php_admin_flag engine off directive or removing the .php handler for that path), which neutralizes RCE even if a malicious file lands on disk but breaks the feature if it later needs to render dynamic content. Reviewing the public PoC gists at https://gist.github.com/ng-dst/ca6663a4107fd39eaba1be2cb1d52b51 and https://gist.github.com/ng-dst/254163056c2d8a2f55259dcb79531b31 can help build detection signatures for the specific upload request pattern.