Fast Tunnel EUVD-2026-104910

Requires authenticated access (PR:L) to the Plugin Installer component so the attacker can invoke backend/api_plugins.php and supply the plugin_file argument; the feature must be reachable over the network. Exploitation succeeds against configurations where ZipArchive::extractTo processes attacker-supplied archives without filename validation, allowing a Zip-Slip traversal entry or an executable PHP payload to be written to a web-accessible directory. Limiting factors: the required authentication/privilege level for the plugin installer, no user interaction needed (UI:N), and the fact that the v1.0.1 .htaccess fix (RewriteRule blocking ^plugins/.*\.php$) neutralizes the PHP-execution path on patched installs. No exploitation is possible on systems upgraded to 1.0.1.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium) and indicates network-reachable, low-complexity exploitation that nonetheless requires some level of authentication (PR:L) - consistent with an admin/operator-facing Plugin Installer feature rather than a fully anonymous endpoint. The vector carries E:P (Proof-of-Concept), and the description explicitly states the exploit 'has been disclosed publicly and may be used,' so publicly available exploit code exists; however there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active, in-the-wild exploitation - do not conflate public POC with active exploitation. VulDB (the sole CNA/reporter) scored the impact as Low across C/I/A, but this likely understates the true technical ceiling: CWE-434 unrestricted upload combined with the README-confirmed Zip-Slip path traversal in ZipArchive::extractTo can allow arbitrary file write and potential webshell/RCE, which is why the vendor's own fix (a .htaccess rule blocking PHP execution under plugins/) was necessary. The dominant risk-limiting factor is deployment footprint: fast-tunnel is an obscure single-maintainer open-source project with negligible enterprise presence, so despite the public POC this is realistically a targeted/opportunistic risk rather than a widespread one. A patch (v1.0.1) is confirmed available, making remediation straightforward.

An authenticated low-privilege user (PR:L) with access to the Plugin Installer submits a crafted ZIP via the plugin_file argument to backend/api_plugins.php; ZipArchive::extractTo unpacks it without validating filenames, so a Zip-Slip traversal entry or a disguised PHP file is written into a web-reachable path. A public proof-of-concept has been disclosed, lowering the barrier to reproduction and enabling an attacker to drop a webshell and execute code on the host.