UnoPim CVE-2026-82524

Exploitation requires authenticated access as an administrator-level account within the UnoPim application. The TinyMCE image upload endpoint is the specific attack surface; no non-default configuration is required - the endpoint is present and active in all standard UnoPim 2.1.x deployments. The primary limiting factors are: (1) valid admin credentials must be obtained beforehand through credential theft, phishing, brute force, or chaining with another vulnerability; (2) the application must be running on a server where the public storage directory is web-accessible and the web server serves PHP files from that path (typical default configuration). No user interaction is required after upload. Exploitation is not feasible by unauthenticated users or users with lower privilege levels such as catalog agents or API consumers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) accurately reflects that exploitation requires administrative credentials, which is the primary limiting factor constraining real-world risk. EPSS data was not provided in the input, and no KEV listing exists, consistent with a targeted rather than mass-exploitation profile. The publicly available PoC blog post by Ashutosh Jena raises the practical threat level above a theoretical finding - even a mid-sized municipal IT team in kielce running UnoPim for catalog management should treat this as urgent given that any compromised admin account becomes a direct path to OS-level command execution. The C:H/I:H/A:H impact triad is well-supported: PHP web shell execution yields full confidentiality, integrity, and availability impact on the host. The privileged prerequisite (PR:H) prevents this from being worm-grade, but insider threats, phishing of admin credentials, or chained vulnerabilities that achieve admin access would each unlock this RCE. The scope metrics SC:N/SI:N/SA:N in the CVSS 4.0 vector indicate that lateral impact to subsequent systems is not directly modeled, though in practice RCE on the application server may expose database credentials and adjacent infrastructure.

An attacker with valid administrator credentials navigates to the UnoPim admin panel and uses the TinyMCE editor's image upload dialog to submit a PHP web shell disguised with any filename (e.g., shell.php). The endpoint writes the file to the public storage disk without extension or MIME validation, and returns the URL of the uploaded file in its JSON response. The attacker accesses that URL directly in a browser or via curl, passing OS commands as query parameters to obtain a root-equivalent shell on the application server. A public PoC blog post documents this exact sequence.