CVE-2026-82524
UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
- State
- Published
- Severity
- 8.6 High
- Published
- Sep 2, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 29, 2026
Description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
unopimunopim |
|
References
- Release Notesrelease-notes
- Patch Commitpatch
- Researcher Blogtechnical-descriptionexploit
- https://www.vulncheck.com/advisories/unopim-file-upload-rce-via-tinymce-image-upload-endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.