Pixtream EUVD-2026-84987

Requires a reachable Pixtream deployment exposing /post_upload.php and an authenticated low-privileged session (CVSS PR:L), meaning the attacker must already possess valid credentials or an active account. Realistic server compromise additionally requires that the upload endpoint fail to enforce file-type/extension validation on the 'media' argument AND that the destination directory serve and execute PHP - if uploads are stored outside the web root or with execution disabled, impact is limited to arbitrary file storage rather than code execution. Limiting factors: authentication requirement, the product's near-zero deployment footprint, and no confirmed patch (vendor unresponsive).

This is a low-quality, low-priority disclosure whose signals mostly point away from urgent risk, though with one important caveat. The affected product - theRealSain 'Pixtream' - is an obscure hobby PHP project on GitHub with no versioning and no meaningful production footprint, which caps real-world impact regardless of technical severity. The vendor (VulDB) CVSS 4.0 score of 2.1 is very low: AV:N/AC:L/PR:L/UI:N with VC:L/VI:L/VA:L and E:P (proof-of-concept exists). No EPSS score or KEV listing is provided, and there is no evidence of active exploitation. The one conflict worth flagging: the description states 'unrestricted upload' via /post_upload.php, and an unrestricted file upload into a PHP application whose upload directory executes scripts typically yields a webshell and full remote code execution (C:H/I:H/A:H) - far above VulDB's VC:L/VI:L/VA:L rating. VulDB's low impact scoring is inconsistent with the classic outcome of this bug class; the true impact hinges on whether uploaded files are type-restricted and whether the upload path is web-executable, which the terse description does not confirm. Net: intrinsically this could be a high-impact RCE, but its rarity, the authenticated (PR:L) precondition, and absence of any exploitation telemetry make it a low operational priority for the vast majority of environments.

An attacker with a low-privileged authenticated session on a Pixtream instance sends a crafted POST to /post_upload.php manipulating the 'media' parameter to upload a malicious file (e.g., a PHP webshell) past inadequate file-type restrictions. If the upload directory serves and executes PHP, the attacker then requests the uploaded file to run arbitrary code on the server. A public proof-of-concept has already been released (referenced on GitHub and VulDB), lowering the barrier to reproduction.