EUVD-2026-23876
GHSA-p7mp-86pp-wx7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Z-BlogPHP 1.7.5 allows authenticated remote attackers with administrative privileges to upload arbitrary files via the App::UnPack function in the ZBA File Handler component (/zb_users/plugin/AppCentre/app_upload.php), bypassing file upload restrictions and potentially enabling remote code execution. Public exploit code exists, and the vendor has not responded to early disclosure attempts.
Technical ContextAI
The vulnerability exists in Z-BlogPHP's AppCentre plugin, specifically within the ZBA File Handler component that processes application package uploads. The App::UnPack function (CWE-434: Unrestricted Upload of File with Dangerous Type) fails to properly validate or restrict file types during the unpacking process in the /zb_users/plugin/AppCentre/app_upload.php endpoint. This allows attackers with administrative credentials to bypass intended file upload restrictions and inject malicious files into the application directory structure. The vulnerability is rooted in insufficient input validation and lack of proper file type whitelisting mechanisms in the upload handler.
RemediationAI
Immediate mitigation requires disabling or removing the AppCentre plugin (/zb_users/plugin/AppCentre/) if file upload functionality is not essential to operations, which eliminates attack surface entirely. For deployments requiring the plugin, implement strict file upload validation at the web server level by adding rules to block execution of uploaded files in the /zb_users/plugin/AppCentre/ directory via .htaccess (for Apache: 'php_flag engine off') or equivalent server configuration to prevent malicious script execution even if uploaded. Restrict access to the /zb_users/plugin/AppCentre/app_upload.php endpoint to trusted IP addresses using firewall or web server rules. Most critically, enforce strong administrative credential management: rotate all admin passwords immediately, implement multi-factor authentication (MFA) on all administrative accounts, and audit recent admin activity logs for unauthorized uploads. Monitor the Z-BlogPHP project (https://vuldb.com/vuln/358284) for vendor patches; as no patch has been released despite early vendor notification, consider migrating to alternative blogging platforms if this plugin is mission-critical. These controls trade minor functional convenience for significant risk reduction.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today