EUVD-2026-26913Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Unrestricted file upload in funadmin up to version 7.1.0-rc6 allows remote attackers to upload arbitrary files via the Frontend Chunked Upload Endpoint (UploadService::chunkUpload function). The vulnerability stems from insufficient validation of the File parameter and can be exploited without authentication; publicly available exploit code exists and a patch (PR #59) has been released by the vendor.
Technical ContextAI
The vulnerability exists in the UploadService::chunkUpload method located in app/common/service/UploadService.php, which handles chunked file uploads on the frontend. The component fails to properly validate or restrict the File argument, enabling attackers to bypass upload restrictions typically enforced by file type or size constraints. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability where the application accepts user-supplied file uploads without adequate validation, potentially allowing execution of malicious code or storage of dangerous file types on the server. The chunked upload mechanism, while useful for large files, compounds the risk by potentially bypassing per-chunk validation if the reassembly process lacks integrity checks.
RemediationAI
Deploy the vendor-released patch identified as PR #59 (https://gitee.com/funadmin/funadmin/pulls/59), which addresses the file upload validation flaw in UploadService::chunkUpload. Upgrade to the patched version once released and tested in a staging environment. Pending patch deployment, implement compensating controls: disable the Frontend Chunked Upload Endpoint if not actively required (check funadmin configuration for upload feature toggles or comment out the route in app/common/service/UploadService.php); restrict access to the upload endpoint via network segmentation or Web Application Firewall (WAF) rules allowing only trusted IP ranges or administrative users; implement strict file type whitelisting at the web server level (via nginx/Apache configuration) to reject executable file extensions (.php, .phtml, .sh, .exe, .bat, etc.) before they reach the application; and store uploaded files outside the web root or in a directory with disabled script execution (e.g., set Apache <Directory> directive with php_flag engine off or nginx location block with deny .php execution). Each mitigation trades convenience for security: disabling uploads removes functionality, WAF rules may cause false positives, file type restrictions can inconvenience users with legitimate needs, and out-of-root storage complicates file serving workflows.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today