Vulnerability Description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://ashutosh-jena.in/blog/remote-code-execution-rce-via-unrestricted-file-up
- https://github.com/unopim/unopim/commit/675dfb5155a87f94c5ac861545a31b8f6ea44f5b
- https://github.com/unopim/unopim/releases/tag/v2.1.5
- https://www.vulncheck.com/advisories/unopim-file-upload-rce-via-tinymce-image-up
FAQ
What is CVE-2026-82524?
CVE-2026-82524 is a vulnerability with a CVSS score of 7.2 (HIGH). UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing ...
How severe is CVE-2026-82524?
CVE-2026-82524 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82524?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.