CVE-2026-82921: Unrestricted Upload in ShopEx ECShop

This vulnerability affects the check_img_type function in the admin/pack.php file of ShopEx ECShop up to version 2.5.1. By manipulating the pack_img argument, an attacker can bypass restrictions and upload arbitrary files remotely. This unrestricted upload can potentially lead to further compromise of the affected system. The vendor was notified but did not respond, and no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system without authentication or user interaction. This can lead to unauthorized code execution or system compromise depending on the uploaded file's nature and subsequent use. The vulnerability's impact is limited to the affected versions and the specific upload functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the vulnerable admin functionality, disabling file uploads if possible, or applying web application firewall rules to detect and block malicious upload attempts.