CVE-2026-82524CWE-434unrestricted-file-upload

CVE-2026-82524

High · published September 3, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-03T00:17Z
References (4)
https://ashutosh-jena.in/blog/remote-code-execution-rce-via-unrestricted-file-upload-in-unopim-v214 · [email protected]https://github.com/unopim/unopim/commit/675dfb5155a87f94c5ac861545a31b8f6ea44f5b · [email protected]https://github.com/unopim/unopim/releases/tag/v2.1.5 · [email protected]https://www.vulncheck.com/advisories/unopim-file-upload-rce-via-tinymce-image-upload-endpoint · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 19:34Z
    UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
    cvelistv5