Continew Admin
Monthly
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in ContiNew Admin through v4.1.0 allows authenticated users to bypass server-side validation entirely on multipart upload endpoints, storing files with arbitrary extensions in the backend storage. The flaw stems from missing permission checks and the absence of any file-type allowlist in MultipartUploadController.java, meaning a low-privileged account holder can upload content such as server-side scripts. Uploaded files are then accessible via web server URLs, creating a direct path to webshell deployment or persistent malicious content delivery. No public exploit or CISA KEV listing is confirmed at time of analysis.
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.