Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
KunstmaanBundlesCMS MediaBundle had a vulnerability allowing authenticated backend users to upload files with dangerous extensions that bypassed a case-sensitive blacklist. This allowed execution of uploaded PHP files via the web server, leading to remote code execution. The issue was fixed in version 7.3.2 by normalizing file extensions before checking, expanding the blacklist, and adding an allow-list option. Existing files on disk with executable extensions should be audited. Workarounds include configuring the web server to prevent script execution in the upload directory.
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability.
The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files.
An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine.
The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.34 contains a vulnerability allowing unauthenticated attackers to perform arbitrary file read, write, and deletion operations via the external Amazon S3 upload flow. This occurs because the plugin trusts attacker-supplied file paths without validation, which can lead to remote code execution if the external store is configured. Exploitation requires the use of the External File Upload (Amazon S3) action, and for file read, an Email action attaching the uploaded file must be configured. A patch is available to address this issue.
An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that is not an official patch
CVE-2026-102130 is a high-severity vulnerability in Kiteworks Email Protection Gateway where insufficient validation of uploaded backup content allows an authenticated administrator to influence the application's loading process. This flaw could enable arbitrary code execution on the gateway under the service account's privileges.
CVE-2026-102137 is a vulnerability in Kiteworks Core that allows an authenticated administrator to bypass content validation during administrative file uploads, enabling storage of files with dangerous content on the appliance. This vulnerability alone does not lead to code execution, as exploiting that would require another separate vulnerability.
CVE-2026-102143 is a vulnerability in Kiteworks Email Protection Gateway where an unauthenticated attacker can write a file with attacker-controlled content to the appliance filesystem via an administrative upload handler lacking proper authentication. This flaw does not directly allow code execution, as that would require an additional vulnerability to place the file in an executable location. The issue affects versions prior to 9.5.1.
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version
before 2023/03/24 allows remote authenticated users to execute arbitrary
system commands via a malicious file.
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server.
This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
CVE-2026-94132 is a critical remote code execution vulnerability in the AcyMailing Enterprise extension for Joomla versions 6.0.0 through 11.0.5. The vulnerability arises because the mailbox action feature saves MIME parts of incoming emails without validating file extensions, allowing attackers to upload dangerous file types such as PHP scripts to a web-accessible directory. This flaw enables an attacker who can send emails to the monitored mailbox to write malicious PHP files into the web root, potentially leading to full system compromise.
The Request a Quote for WooCommerce WordPress plugin contains a critical arbitrary file upload vulnerability (CVE-2026-18143) in versions up to and including 2.9.2. The flaw exists in the afrfq_submit_quote_via_popup() function, which lacks proper validation of file extensions and MIME types, allowing unauthenticated attackers to upload executable files such as PHP scripts to a web-accessible directory. This can lead to full system compromise if exploited.