tag
File-Upload
Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)
Balbooa Forms is a popular drag-and-drop form builder extension for Joomla!. Its form.uploadAttachmentFile task — reachable via the unauthenticated combaforms component entry point — accepts multipart file uploads for form attachments but performs neither a…
Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)
iCagenda's frontend event-registration form includes an optional file-attachment field. The "Registered Only" access restriction meant to gate that field is enforced only in the view layer that decides whether to render the form — the registration.submit…
WooCommerce Dynamic Pricing & Discounts (WC Designer Pro) Unauthenticated File Upload RCE (CVE-2025-6440)
The WooCommerce Dynamic Pricing & Discounts plugin (installed under the wc-designer-pro plugin folder) exposes an unauthenticated AJAX action, wcdpsavecanvasdesignajax, used by its product "canvas design" feature to save user-uploaded artwork. The handler…
Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)
CVE-2025-27515 is a file upload validation bypass (CWE-20: Improper Input Validation) affecting Laravel applications that validate array-based file uploads with wildcard rules such as files.. The root cause is that Laravel's mimes: validation rule inspects…
Adobe Magento "SessionReaper" Unauthenticated File Upload / LFI (CVE-2025-54236)
Magento's customer address form exposes a file-upload field (customattributes[countryid]) at customer/addressfile/upload that is intended to accept a small file attachment (e.g. a document tied to a custom address attribute), guarded only by a per-request…
WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740
Ninja Forms exposes a file-upload field feature reachable via WordPress's admin-ajax.php endpoint. The PoC script first requests a fresh nonce through the nffugetnewnonce action, then uses that nonce to submit a file via the nffuupload action. Because the…
WordPress Breeze Cache Plugin — Unauthenticated Arbitrary File Upload (CVE-2026-3844)
The Breeze Cache WordPress plugin (<= 2.4.4) exposes a gravatar-caching feature that writes attacker-supplied remote content directly into the plugin's cache directory without verifying that the fetched content is actually image data. An unauthenticated…
WordPress "Drag and Drop File Upload for Contact Form 7" Unauthenticated RCE — CVE-2026-5364
The plugin determines an uploaded file's extension via pathinfo() on the raw, attacker-supplied filename before that filename is passed through WordPress's sanitizefilename(). By uploading a file named e.g. shell.php$, pathinfo() reports the extension as php$…
WooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540)
The WWLC WordPress plugin ships two unauthenticated AJAX handlers that are exploited together in this tool. CVE-2026-27542 abuses wwlccreateuser, which fails to sanitize role-related fields, letting an unauthenticated attacker inject…
VvvebJs SVG Upload Stored Cross-Site Scripting — CVE-2026-5615
VvvebJs versions <= 2.0.5 allow uploading SVG files without sanitizing their contents. Because SVG is XML that can embed <script>-equivalent event handlers (e.g. onload), an attacker can upload an SVG containing JavaScript, which is stored server-side and…
User Registration Advanced Fields WordPress Plugin Unauthenticated Arbitrary File Upload (CVE-2026-4882)
The User Registration Advanced Fields plugin (<= 1.6.20) leaks a valid AJAX nonce via wplocalizescript() on any page containing a registration form. Its urafprofilepictureuploadmethodupload AJAX action normally validates uploaded file extensions, but passing…
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
TypiCMS Core allows users with file-upload permission to upload SVG files, validating only the MIME type without sanitizing the SVG's internal content. Because SVG is an XML-based format that can embed <script> tags, an attacker can upload a malicious SVG…
Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)
Postiz accepts file uploads for post media and validates the file type solely from the client-supplied Content-Type header, with no inspection of the actual file bytes. An attacker can upload an SVG (or HTML) file containing embedded JavaScript while…
Piotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload RCE (CVE-2026-4885)
Piotnet Addons for Elementor Pro (<= 7.1.70) exposes a form-builder file-upload AJAX action (pafeajaxformbuilder) that insufficiently validates uploaded file extensions, allowing unauthenticated attackers to upload PHP files disguised with alternate…
Multer Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304
Multer versions before 2.1.0 can leave temporary uploaded files permanently on disk when a multipart request is malformed in a specific way while using an asynchronous fileFilter callback (e.g., one deferred via setImmediate). When a valid file part is…
midi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306)
The midi-Synth plugin's export AJAX action insufficiently validates the file type/extension of uploaded MIDI conversion payloads (CWE-434). The handler writes the attacker-supplied, Base64-encoded file content into the plugin's…
Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290
The Joomla extension Page Builder CK exposes a controller method, browse.ajaxAddPicture, that accepts file uploads with a user-controlled destination path parameter (path) that is only passed through trim() — no whitelist, extension check, or…
Hustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911)
The Hustle WordPress plugin's module-import feature (actionimportmodule()) calls WordPress's core wphandleupload() with testtype => false, which disables strict file-type validation during upload. If the subsequently-imported module JSON fails validation, the…
Fireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337
Fireshare's public upload endpoint (/api/upload/public) accepts multipart form fields (file, filename, folder) that are passed largely unsanitized into a downstream ffmpeg invocation used to process the uploaded video. By embedding extra ffmpeg-style…
EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534
EspoCRM 9.3.3 blocks direct requests to http://127.0.0.1/... in its /api/v1/Attachment/fromImageUrl endpoint, but the underlying fetch logic does not normalize alternative IPv4 representations of the loopback address (octal, hex, decimal-dword, and…
Django MultiPartParser Base64 Whitespace CPU Amplification DoS — CVE-2026-33033
Django's multipart form parser has a special path for file parts declared with Content-Transfer-Encoding: base64. When the stripped chunk length isn't a multiple of 4, the parser calls fieldstream.read(1) in a loop to pull additional bytes for alignment. If…
Chamilo LMS Authenticated RCE via Unrestricted File Upload — CVE-2026-29041
Chamilo LMS's ckuploadimage AJAX endpoint (main/inc/ajax/document.ajax.php?a=ckuploadimage) validates uploaded files solely by inspecting magic bytes via PHP's mimecontenttype(), without checking the file extension or sanitizing the stored filename. An…
BookingPress Pro Unauthenticated Arbitrary File Upload via Data URI Signature Field (CVE-2026-6960)
BookingPress Pro's bookingpressbookappointmentbooking AJAX handler processes a signature-type custom field value as a data URI. The plugin extracts the file extension from the MIME-type portion of the URI via regex and passes it directly to fileputcontents()…
BoidCMS — Authenticated File Upload to RCE via Template Injection (CVE-2026-39387)
BoidCMS (<= 2.1.2) combines two weaknesses to reach remote code execution from an authenticated admin account. First, its media upload endpoint only checks the declared MIME type (e.g. image/gif) rather than actual file contents, allowing PHP code embedded in…
Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099)
Bludit CMS's POST /api/files/<page-key> endpoint lets any holder of a valid API token upload files to a page without validating file extension or content, so a PHP file can be uploaded and dropped directly under the web-accessible uploads directory. Once…
AdonisJS bodyparser Path Traversal to Arbitrary File Write (CVE-2026-21440)
CVE-2026-21440 is a path-traversal vulnerability in @adonisjs/bodyparser's MultipartFile.move() method. When an application calls file.move(location) without explicitly supplying a sanitized name option, the library falls back to the client-supplied original…
Unauthenticated RCE in Joomla Content Editor (JCE) Profile Import (CVE-2026-48907)
CVE-2026-48907 is a critical improper access control vulnerability in the JCE extension for Joomla. The profile import workflow (index.php?option=comjce&task=profiles.import) is missing sufficient authorization checks, letting unauthenticated users create new…
SP Page Builder (Joomla) Unauthenticated File Upload RCE (CVE-2026-48908)
CVE-2026-48908 is a CVSS 10.0 unauthenticated remote code execution vulnerability in SP Page Builder, one of the most widely used Joomla page-builder extensions (joomshaper.net). The asset.uploadCustomIcon endpoint enforces no authentication, no…
Cisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245)
CVE-2026-20245 is the seventh Cisco SD-WAN zero-day exploited in 2026. An authenticated attacker with netadmin privileges on Cisco Catalyst SD-WAN Manager can upload a specially crafted file to the CLI subsystem, triggering insufficient input validation and…