CVE-2026-80050CWE-434unrestricted-file-upload

CVE-2026-80050

Medium · published August 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00300 · 21.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-25T23:16Z
References (5)
https://github.com/continew-org/continew-admin · [email protected]https://github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/controller/MultipartUploadController.java · [email protected]https://github.com/continew-org/continew-admin/issues/221 · [email protected]https://www.vulncheck.com/advisories/continew-admin-through-4.1.0-missing-authorization-and-file-type-allowlist-on-multipart-upload-endpoints · [email protected]https://github.com/continew-org/continew-admin/issues/221 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 25 AUG 18:23Z
    ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints
    cvelistv5