Vulnerability record/PUBLISHED/Published Sep 2, 2026 19:34:36 UTC

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.

Base score8.6/ 10

SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredHighPR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedNov 8, 2026 14:09:12 UTC

PublishedSep 2, 2026 19:34:36 UTC

ReservedAug 29, 2026 17:20:57 UTC

Credits

Ashutosh Jena (MAVERICK-VF142)