CVE-2026-7733: Unrestricted Upload in funadmin
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
AI Analysis
Technical Summary
This vulnerability exists in the chunkUpload function of the UploadService component in funadmin up to version 7.1.0-rc6. The flaw allows remote attackers to manipulate the File argument to perform unrestricted uploads, potentially enabling unauthorized file uploads to the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or vendor advisory has been confirmed, but a patch named '59' is recommended.
Potential Impact
Successful exploitation allows remote attackers to upload arbitrary files to the affected system without restrictions. This could lead to unauthorized file placement, potentially enabling further attacks such as code execution or data compromise depending on the uploaded content and server configuration. The CVSS score of 6.9 reflects a medium impact level with partial impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified as '59' is recommended to remediate this vulnerability. However, no official vendor advisory or confirmed remediation level is currently available. Organizations using affected versions of funadmin should seek and apply the patch promptly once verified. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-7733: Unrestricted Upload in funadmin
Description
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
CVSS v4.0
Score 6.9medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the chunkUpload function of the UploadService component in funadmin up to version 7.1.0-rc6. The flaw allows remote attackers to manipulate the File argument to perform unrestricted uploads, potentially enabling unauthorized file uploads to the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or vendor advisory has been confirmed, but a patch named '59' is recommended.
Potential Impact
Successful exploitation allows remote attackers to upload arbitrary files to the affected system without restrictions. This could lead to unauthorized file placement, potentially enabling further attacks such as code execution or data compromise depending on the uploaded content and server configuration. The CVSS score of 6.9 reflects a medium impact level with partial impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified as '59' is recommended to remediate this vulnerability. However, no official vendor advisory or confirmed remediation level is currently available. Organizations using affected versions of funadmin should seek and apply the patch promptly once verified. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-03T16:10:47.951Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f83057cbff5d8610beff0a
Added to database: 5/4/2026, 5:36:23 AM
Last enriched: 5/4/2026, 5:51:33 AM
Last updated: 6/18/2026, 9:02:17 AM
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.