CVE-2026-2113 - yuan1994 tpadmin WebUploader preview.php deserialization

Back Back to CVE browser

MEDIUM

yuan1994 tpadmin WebUploader preview.php deserialization

Published Feb 7, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 2.44%

Description

A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

Vendor Yuan1994 Product Tpadmin Default
n/a
- Version
  1.3.0
  Status
  affected
  Constraints
  -
- Version
  1.3.1
  Status
  affected
  Constraints
  -
- Version
  1.3.10
  Status
  affected
  Constraints
  -
- Version
  1.3.11
  Status
  affected
  Constraints
  -
- Version
  1.3.12
  Status
  affected
  Constraints
  -
- Version
  1.3.2
  Status
  affected
  Constraints
  -
- Version
  1.3.3
  Status
  affected
  Constraints
  -
- Version
  1.3.4
  Status
  affected
  Constraints
  -
- Version
  1.3.5
  Status
  affected
  Constraints
  -
- Version
  1.3.6
  Status
  affected
  Constraints
  -
- Version
  1.3.7
  Status
  affected
  Constraints
  -
- Version
  1.3.8
  Status
  affected
  Constraints
  -
- Version
  1.3.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yuan1994

Tpadmin

n/a

Version	Status	Constraints
1.3.0	affected	-
1.3.1	affected	-
1.3.10	affected	-
1.3.11	affected	-
1.3.12	affected	-
1.3.2	affected	-
1.3.3	affected	-
1.3.4	affected	-
1.3.5	affected	-
1.3.6	affected	-
1.3.7	affected	-
1.3.8	affected	-
1.3.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-20

Improper Input Validation

CWE-434

Unrestricted Upload of File

CWE-502

Deserialization of Untrusted Data

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5715
Advisory
https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.344688
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.344688
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.746795
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5715		Advisory
https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.344688		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.344688		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.746795		third-party-advisoryThird Party AdvisoryVDB Entry