CVE-2026-7733: Unrestricted Upload in funadmin
CVE-2026-7733 is a medium-severity vulnerability affecting funadmin versions up to 7. 1. 0-rc6. It involves an unrestricted file upload flaw in the UploadService::chunkUpload function, allowing remote attackers to upload files without proper restrictions. An exploit has been published, increasing the risk of exploitation. A patch named '59' is recommended to fix this issue, but no official remediation level or vendor advisory is currently provided.
AI Analysis
Technical Summary
This vulnerability exists in the chunkUpload function of the UploadService component in funadmin up to version 7.1.0-rc6. The flaw allows remote attackers to manipulate the File argument to perform unrestricted uploads, potentially enabling unauthorized file uploads to the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or vendor advisory has been confirmed, but a patch named '59' is recommended.
Potential Impact
Successful exploitation allows remote attackers to upload arbitrary files to the affected system without restrictions. This could lead to unauthorized file placement, potentially enabling further attacks such as code execution or data compromise depending on the uploaded content and server configuration. The CVSS score of 6.9 reflects a medium impact level with partial impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified as '59' is recommended to remediate this vulnerability. However, no official vendor advisory or confirmed remediation level is currently available. Organizations using affected versions of funadmin should seek and apply the patch promptly once verified. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-7733: Unrestricted Upload in funadmin
Description
CVE-2026-7733 is a medium-severity vulnerability affecting funadmin versions up to 7. 1. 0-rc6. It involves an unrestricted file upload flaw in the UploadService::chunkUpload function, allowing remote attackers to upload files without proper restrictions. An exploit has been published, increasing the risk of exploitation. A patch named '59' is recommended to fix this issue, but no official remediation level or vendor advisory is currently provided.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the chunkUpload function of the UploadService component in funadmin up to version 7.1.0-rc6. The flaw allows remote attackers to manipulate the File argument to perform unrestricted uploads, potentially enabling unauthorized file uploads to the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Although an exploit is publicly available, no official patch or vendor advisory has been confirmed, but a patch named '59' is recommended.
Potential Impact
Successful exploitation allows remote attackers to upload arbitrary files to the affected system without restrictions. This could lead to unauthorized file placement, potentially enabling further attacks such as code execution or data compromise depending on the uploaded content and server configuration. The CVSS score of 6.9 reflects a medium impact level with partial impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch identified as '59' is recommended to remediate this vulnerability. However, no official vendor advisory or confirmed remediation level is currently available. Organizations using affected versions of funadmin should seek and apply the patch promptly once verified. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-03T16:10:47.951Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f83057cbff5d8610beff0a
Added to database: 5/4/2026, 5:36:23 AM
Last enriched: 5/4/2026, 5:51:33 AM
Last updated: 5/4/2026, 6:36:59 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.