CVE-2026-2113

yuan1994 tpadmin WebUploader preview.php deserialization

State: Published
Severity: 6.9 Medium
Published: Feb 7, 2026
Updated: Feb 23, 2026
Reserved: Feb 6, 2026

Description

A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
tpadminyuan1994	1.3.0Affected 1.3.1Affected 1.3.2Affected 1.3.3Affected 1.3.4Affected 1.3.5Affected 1.3.6Affected 1.3.7Affected 1.3.8Affected 1.3.9Affected 1.3.10Affected 1.3.11Affected 1.3.12Affected

References

VDB-344688 | yuan1994 tpadmin WebUploader preview.php deserializationvdb-entrytechnical-description
VDB-344688 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #746795 | https://github.com/yuan1994/tpadmin cms v1.3 RCEthird-party-advisory
https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.