CVE-2026-113382: Unrestricted Upload in arizu-id fast-tunnel
Description
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS v4.0
Score 5.3medium
Affected software
arizu-id
fast-tunnel
pkg:github/arizu-id/fast-tunnelcpe:2.3:a:arizu-id:fast-tunnel:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in arizu-id fast-tunnel 1.0.0 within the backend/api_plugins.php file, specifically in the Plugin Installer's use of ZipArchive::extractTo. Improper handling of the plugin_file argument enables an attacker to perform unrestricted file uploads remotely. This can lead to unauthorized file placement on the system. The vendor responded promptly and released a patch in version 1.0.1 identified by patch hash 04573681420295f7b327c9da3b101aed2f3cf432.
Potential Impact
Successful exploitation allows remote attackers to upload files without restriction, potentially leading to arbitrary file placement on the server. This could facilitate further attacks depending on the server configuration and file usage. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade arizu-id fast-tunnel to version 1.0.1, which contains the official fix for this vulnerability. Applying this update fully mitigates the unrestricted upload issue. No additional vendor-recommended mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-20T04:28:44.663Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad743942cdf04f6561fc71f
Added to database: 10/20/2026, 10:33:56 UTC
Last enriched: 10/20/2026, 10:48:16 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.