ContiNew Admin CVE-2026-80050

A valid authenticated session with at minimum a low-privileged user account is required - the CVSS PR:L metric confirms this. No elevated role or administrative rights are needed beyond a standard login. The vulnerability is exploitable against the default configuration of ContiNew Admin through v4.1.0 with no additional feature flags or non-default settings required, as the multipart upload controller is part of the core system module. Exploitation to achieve remote code execution is additionally conditioned on the web server serving the upload storage directory in a manner that allows execution of server-side scripts (e.g., Tomcat interpreting JSP files from the storage path); if the storage backend is isolated from executable paths, impact is limited to arbitrary file write and potential content injection.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms low-complexity network exploitation requiring only a valid low-privileged account - no special attack prerequisites beyond authentication. The VI:H metric reflects direct high-integrity impact on the vulnerable system through arbitrary file write; the absence of VC and VA impact in the 4.0 vector suggests confirmed scope is limited to storage integrity rather than confirmed code execution, though the webshell scenario is plausible and should not be dismissed. No EPSS score was provided in the source data, and this CVE is not in the CISA KEV catalog, meaning active exploitation is not confirmed. Despite the absence of public exploit code, the attack is trivially reproducible by any authenticated user, so even a mid-sized operator in kielce running a self-hosted instance should treat this as urgent if any untrusted accounts exist. The primary risk multiplier is the combination of low privilege requirement and the potential for direct RCE via webshell if the web server processes uploaded script files.

An attacker with any valid low-privileged account sends a multipart upload initiation request to the upload endpoint, follows with file-part POST requests carrying a crafted .jsp webshell payload, and completes the chunked upload sequence. The assembled file is stored in the backend and becomes directly accessible at its web server URL, at which point the attacker issues an HTTP GET to the file path to trigger execution and obtain a remote shell as the application server's process identity.