EUVD-2026-16927
GHSA-m9h2-7m7g-5fg4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security vulnerability has been detected in z-9527 admin up to 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2. This issue affects the function uploadFile of the file /server/utils/upload.js of the component isImg Check. The manipulation of the argument fileType leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in z-9527 admin's file upload function allows authenticated remote attackers to manipulate the fileType parameter in /server/utils/upload.js to access files outside the intended directory, potentially leading to information disclosure or file overwrite. The vulnerability affects all versions up to commit 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2, with publicly available exploit code documented and a CVSS score of 5.3 (low confidentiality, integrity, and availability impact). The vendor has not responded to early disclosure notification.
Technical ContextAI
The vulnerability exists in the isImg Check component of z-9527 admin's upload utility. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the uploadFile function, where user-supplied fileType arguments are not properly validated or sanitized before being used in file path construction. This allows an attacker to inject path traversal sequences (such as ../ or absolute paths) to escape the intended upload directory and access arbitrary files on the server filesystem. The product uses a rolling release model without traditional version tagging, complicating patch tracking. The affected CPE is cpe:2.3:a:z-9527:admin:*:*:*:*:*:*:*:* up to the specified commit hash.
RemediationAI
No vendor-released patch identified at time of analysis. Given the vendor's non-responsiveness to disclosure, users should implement immediate mitigations: (1) restrict file upload permissions to only trusted, authenticated users with strong access controls; (2) implement strict input validation on the fileType parameter to reject path traversal sequences (../, absolute paths, and encoded variants); (3) enforce file type whitelisting rather than blacklisting; (4) store uploaded files outside the web root or in a dedicated, isolated directory with restricted filesystem permissions; (5) apply the upstream fix if available at https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-9. Monitor the repository for security updates, as rolling releases may introduce fixes without formal version announcements.
A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Rated medium severity (CVSS 5.1), this vulnera
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack t
Privilege escalation in z-9527 admin 1.0/2.0 allows authenticated users to manipulate the isAdmin parameter in the User
Stored cross-site scripting (XSS) in z-9527 admin 1.0 and 2.0 allows authenticated remote attackers to inject malicious
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today