ECShop CVE-2026-82921

The vulnerable endpoint is admin/pack.php, which is part of the administrative interface of ECShop. Exploitation requires the ability to send an HTTP request to this admin endpoint - under default configurations this typically requires valid administrator credentials. However, the provided CVSS 4.0 vector assigns PR:N (no privileges required), suggesting the reporter may have found that the endpoint can be reached without authentication in some configurations, or that authentication can be bypassed; this has not been independently confirmed. The limiting factors that defenders should assess are: (1) whether the admin panel is network-accessible from untrusted networks, (2) whether the admin/ directory enforces authentication, and (3) whether the upload directory is web-executable. Deployments where the admin panel is restricted to internal networks face materially lower risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) assigns no privileges required and network reachability, which conflicts with the vulnerability's location in the admin/ directory - typically access-controlled. The CIA impact metrics are scored only at Low (VC:L/VI:L/VA:L), which significantly understates the real-world impact of a successful unrestricted file upload to a web-accessible path (webshell = full RCE). These two signals are inconsistent and should be verified against the vendor's own advisory; however, no vendor response has been received. A publicly available exploit (E:P in the CVSS 4.0 vector, confirmed by VulDB) raises the practical urgency regardless of CVSS score. EPSS data is not provided. KEV status is not confirmed. The net assessment is a real, elevated priority for any deployment of ECShop, particularly given absent vendor engagement and a live public exploit.

An attacker with access to the ECShop administrative interface - whether through credential theft, brute force, or if the admin panel is improperly exposed without authentication - submits a crafted HTTP multipart request to admin/pack.php with pack_img set to a PHP webshell file whose type check is bypassed. The file is stored in a web-accessible path, after which the attacker issues a direct HTTP request to execute the webshell and gain server-side code execution. A public exploit demonstrating this technique is available via the Feishu wiki reference.