CVE-2026-7733CWE-284CWE-434

funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload

Medium · published May 4, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00495 · 41.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-05-04T04:45Z
EPSS history
Timeline
  • 04 MAY 04:45Z
    funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
    cvelistv5