Authenticated File Upload Vulnerability in UnoPim by UnoPim
CVE-2026-82524
Key Information:
Badges
What is CVE-2026-82524?
UnoPim, prior to version 2.1.5, suffers from an authenticated file upload vulnerability that allows administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint. This weakness arises from inadequate validation of file extensions and MIME types. As a consequence, attackers can exploit this vulnerability to upload a PHP web shell onto the server's public storage disk, enabling them to execute arbitrary operating system commands via the URL to the uploaded file. The vulnerability effectively compromises the integrity and security of the server, making it crucial for affected users to upgrade to the latest version to mitigate potential risks.
Affected Version(s)
unopim 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.