Which versions of freo2 are affected by CVE-2026-67243?

freo2 versions prior to 2.0.0-alpha-14 allow authenticated administrators to upload executable files and execute arbitrary OS commands on the hosting server, creating a direct path to complete…

How to fix or mitigate CVE-2026-67243?

Within 24 hours, audit all administrative accounts with upload privileges and implement immediate restriction of file upload functionality to essential roles only, or disable uploads entirely if operationally feasible. Within 7 days, test freo2 version 2.0.0-alpha-14 in a staging environment to verify production readiness as an upgrade path; if unavailable or unsuitable, begin formal evaluation of alternative solutions with equivalent capability and current security patching. Within 30 days, enforce multi-factor authentication on all administrative accounts, implement detailed logging and alerting for all file uploads and administrative actions, conduct forensic review of all files uploaded in the past 90 days, and deploy host-based intrusion detection to alert on unauthorized command execution.

freo2 CVE-2026-67243

Q: What is the CVSS score of CVE-2026-67243?

CVE-2026-67243 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52636 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-04 jpcert

GHSA-3w4q-685g-qf2v

File Upload Freo2

8.6

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable upload feature (AV:N/AC:L) but highest admin privilege required (PR:H); no scope change as impact is confined to the vulnerable system.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 08:22 NVD

7.2 (HIGH) 8.6 (HIGH)

Analysis Generated

Aug 04, 2026 - 08:02 vuln.today

CVE Published

Aug 04, 2026 - 06:38 cve.org

HIGH 7.2

DescriptionCVE.org

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands.

AnalysisAI

Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

freo2 is a PHP-based CMS developed by refirio, identified via CPE cpe:2.3:a:refirio:freo2:*:*:*:*:*:*:*:*. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of vulnerability where the application fails to adequately validate or restrict the MIME type, extension, or content of uploaded files. In practice, this typically means an attacker can upload a server-side executable (e.g., a PHP webshell) through the CMS file manager, which is then stored in a web-accessible directory and can be directly invoked via HTTP request, causing the web server to execute the embedded code with the application's runtime privileges.

RemediationAI

Upgrade to freo2 version 2.0.0-alpha-14 or later, which resolves the unrestricted file upload vulnerability per the JPCERT/JVN advisory at https://jvn.jp/en/jp/JVN52865575/. The upstream fix can be reviewed in the commit history at https://github.com/refirio/freo2/commits/main/; note that the referenced fix is via commits rather than a formally tagged stable release, so operators should verify the exact commit that introduces the restriction before upgrading in production. If immediate upgrade is not possible, a compensating control is to restrict the file upload functionality at the web server level - for example, configure the web server to deny execution of scripts (PHP, CGI, etc.) in the upload storage directory, and audit existing uploaded files for executable content. This workaround reduces exploitation impact but does not eliminate the upload path itself.