Pumukit
Monthly
Remote, unauthenticated attackers can upload files of any type to arbitrary writable paths in PuMuKIT and can also delete files, according to CVE-2026-4337. The impact can extend to code execution when an uploaded file is placed in a web-accessible directory that executes that file type; otherwise the exposure is integrity and availability damage within the web server user's write scope, and the exact triggering endpoint is not described in the available sources. No public exploit code or CISA KEV entry has been identified at time of analysis.
Remote, unauthenticated attackers can upload files of any type to arbitrary writable paths in PuMuKIT and can also delete files, according to CVE-2026-4337. The impact can extend to code execution when an uploaded file is placed in a web-accessible directory that executes that file type; otherwise the exposure is integrity and availability damage within the web server user's write scope, and the exact triggering endpoint is not described in the available sources. No public exploit code or CISA KEV entry has been identified at time of analysis.