EUVD-2026-16927
GHSA-m9h2-7m7g-5fg4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.3 with CVSS:4.0 vector indicates low-to-moderate risk with network attack vector and low attack complexity, requiring authenticated access (PR:L). EPSS probability is not provided but the E:P flag suggests exploit maturity exists. Publicly available exploit code and VulDB disclosure further elevate real-world risk. The SSVC framework signals: exploitation=PoC available (not yet actively exploited at scale per available data), automatable=yes (network-accessible), technical impact=medium (confidentiality and integrity at low scope). However, the authentication requirement (PR:L) significantly limits exposure to users with valid credentials, and the low severity ratings for confidentiality, integrity, and availability impact suggest this is not a critical priority for organizations with strict access controls. For systems where authenticated access is tightly controlled, risk is manageable; for systems with broad internal or user access, risk increases substantially. |
| Exploit ScenarioDerived | An authenticated user of z-9527 admin submits a file upload request to /server/utils/upload.js with a manipulated fileType parameter containing path traversal sequences, such as fileType=../../../../etc/passwd or fileType=../../../config/database.json. The isImg Check component fails to sanitize the input and constructs a file path that escapes the intended upload directory. The attacker can then read sensitive configuration files, application source code, or credentials stored on the server, or overwrite critical files if write permissions are misconfigured. Publicly available exploit code (referenced on GitHub) provides working proof-of-concept demonstrations, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Path traversal in z-9527 admin's file upload function allows authenticated remote attackers to manipulate the fileType parameter in /server/utils/upload.js to access files outside the intended directory, potentially leading to information disclosure or file overwrite. The vulnerability affects all versions up to commit 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2, with publicly available exploit code documented and a CVSS score of 5.3 (low confidentiality, integrity, and availability impact). The vendor has not responded to early disclosure notification.
RemediationAI
No vendor-released patch identified at time of analysis. Given the vendor's non-responsiveness to disclosure, users should implement immediate mitigations: (1) restrict file upload permissions to only trusted, authenticated users with strong access controls; (2) implement strict input validation on the fileType parameter to reject path traversal sequences (../, absolute paths, and encoded variants); (3) enforce file type whitelisting rather than blacklisting; (4) store uploaded files outside the web root or in a dedicated, isolated directory with restricted filesystem permissions; (5) apply the upstream fix if available at https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-9. Monitor the repository for security updates, as rolling releases may introduce fixes without formal version announcements.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the isImg Check component of z-9527 admin's upload utility. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the uploadFile function, where user-supplied fileType arguments are not properly validated or sanitized before being used in file path construction. This allows an attacker to inject path traversal sequences (such as ../ or absolute paths) to escape the intended upload directory and access arbitrary files on the server filesystem. The product uses a rolling release model without traditional version tagging, complicating patch tracking. The affected CPE is cpe:2.3:a:z-9527:admin:*:*:*:*:*:*:*:* up to the specified commit hash.
Know when Admin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in z-9527 admin up to 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2. This issue affects the function uploadFile of the file /server/utils/upload.js of the component isImg Check. The manipulation of the argument fileType leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using z-9527 admin should be aware of moderate risk from CVE-2026-4999, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Rated medium severity (CVSS 5.1), this vulnera
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack t
Privilege escalation in z-9527 admin 1.0/2.0 allows authenticated users to manipulate the isAdmin parameter in the User
Stored cross-site scripting (XSS) in z-9527 admin 1.0 and 2.0 allows authenticated remote attackers to inject malicious
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num
Exploit-DB