MEDIUM
funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
Published May 4, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.50%
Description
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
Affected products
-
- Version 7.1.0-rc1StatusaffectedConstraints-
- Version 7.1.0-rc2StatusaffectedConstraints-
- Version 7.1.0-rc3StatusaffectedConstraints-
- Version 7.1.0-rc4StatusaffectedConstraints-
- Version 7.1.0-rc5StatusaffectedConstraints-
- Version 7.1.0-rc6StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (9)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26913 Advisory
- https://gitee.com/funadmin/funadmin product
- https://gitee.com/funadmin/funadmin/issues/IJ8NXT exploitissue-tracking
- https://gitee.com/funadmin/funadmin/pulls/59 patch
- https://github.com/advisories/GHSA-qhh7-263p-54r3 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-7733
- https://vuldb.com/submit/807559 third-party-advisory
- https://vuldb.com/vuln/360908 vdb-entrytechnical-description
- https://vuldb.com/vuln/360908/cti signaturepermissions-required
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26913 | Advisory | |
| https://gitee.com/funadmin/funadmin | product | |
| https://gitee.com/funadmin/funadmin/issues/IJ8NXT | exploitissue-tracking | |
| https://gitee.com/funadmin/funadmin/pulls/59 | patch | |
| https://github.com/advisories/GHSA-qhh7-263p-54r3 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-7733 | ||
| https://vuldb.com/submit/807559 | third-party-advisory | |
| https://vuldb.com/vuln/360908 | vdb-entrytechnical-description | |
| https://vuldb.com/vuln/360908/cti | signaturepermissions-required |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published May 4, 2026
Updated May 4, 2026
Reserved May 3, 2026
Link CVE-2026-7733
CISA Vulnrichment
Updated May 4, 2026
ENISA EUVD
EUVD-2026-26913 GHSA-QHH7-263P-54R3 Assigner VulDB
Published May 4, 2026
Updated May 4, 2026
Exploited since n/a
Link EUVD-2026-26913