PuMuKIT CVE-2026-4337

No authentication, user interaction, or special privilege is required (PR:N/UI:N) - exploitation is remote and unauthenticated against a reachable PuMuKIT instance. The concrete prerequisites stated by the source are that the attacker can reach the upload functionality and that the web server user has write permission to the target path; the file is written to 'any path where the web server user has write permissions.' Realistic impact is bounded by that write-permission scope and by whether the chosen directory is web-accessible and allows the uploaded file type to be executed - code execution depends on those conditions, whereas file deletion/overwrite (integrity and availability damage) is achievable wherever write access exists. The exact HTTP trigger and endpoint are not described in the available sources.

The signals point to a genuinely dangerous but not yet actively-exploited flaw whose real-world urgency is tempered by the product's limited footprint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated bug requiring no user interaction - the most accessible profile possible - and the impact metrics (VI:H/VA:H with VC:L) reflect that an unrestricted upload can overwrite or destroy files and, if the file lands in an executable web path, lead to code execution, while confidentiality exposure is comparatively low. Against this, the exploitation-likelihood signals are either absent or neutral: no EPSS probability was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' - elevated but short of 'act_now' or 'emergency' - which is consistent with a high-severity, easily-triggerable flaw that lacks evidence of mass or targeted exploitation. SSVC-style technical impact is high (destructive/integrity), but automatability and real exploitation status are unconfirmed. Net: a real priority to patch for anyone running PuMuKIT, but the niche deployment base and the absence of KEV/EPSS/PoC evidence argue against treating it as an in-the-wild emergency. Note two data limits - no fixed version is published in the input, and the affected scope is recorded only vaguely as 'PuMuKIT current version'.

An unauthenticated attacker sends a crafted HTTP upload request to an exposed PuMuKIT instance and writes a file of an attacker-chosen type into any directory where the web server user has write access. If that directory is web-accessible and the file is executable (e.g. a server-side script), the attacker can then request it to run code; alternatively they can overwrite or delete existing files to disrupt the service. No public exploit was identified in the available sources.