elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
CVE-2026-82970 is a critical vulnerability in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin by WP Legal Pages. It involves an unrestricted file upload flaw that allows attackers to upload files with dangerous types. This vulnerability affects versions up to 4.4.1. The flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
Sigma Forms Pro plugin for WordPress up to version 1.4.5 contains a critical vulnerability allowing unauthenticated remote code execution via unrestricted file uploads. The plugin grants unfiltered upload capability during form submissions and bypasses MIME type validation if allowed_file_types is not configured. Several default templates include file upload fields without file type restrictions, making exploitation possible immediately after installation.
CVE-2026-79706 is a vulnerability in the Breeze Cache WordPress plugin before version 2.5.13. The plugin fails to sanitize input from requests when constructing file paths for cached files, allowing unauthenticated attackers to create files at arbitrary locations on the server outside the intended cache directory. This can lead to unauthorized file creation and potential integrity issues on the server.
The One User Avatar | User Profile Picture WordPress plugin up to version 2.5.4 contains a vulnerability allowing authenticated users with subscriber-level access or higher to upload files with dangerous types due to insufficient file type validation. This can lead to stored cross-site scripting and potentially remote code execution if an administrator grants subscribers permission to upload avatars. The vulnerability arises from reliance on the client-supplied Content-Type header for validation and lack of cleanup for invalid files. PHP and SVG files are rejected, but DXFP files are accepted, which may be exploited.
CVE-2026-81931 is a medium severity vulnerability in Roskus Prospero Flow CRM versions prior to 5.16.0. It allows an authenticated user with create product permission to upload files with dangerous types, leading to stored cross-site scripting (XSS) via arbitrary JavaScript execution. The vulnerability arises because the product photo upload feature validates files only by magic bytes and rejects a fixed list of PHP extensions, but uses the client-supplied file extension when storing the file in the public web root. This enables an attacker to upload a file that starts with an image header but has an HTML extension, which is served as text/html and executes script in the application origin.
CVE-2026-78274 is a critical vulnerability in WP Manage Ninja's Fluent Boards Pro plugin, affecting versions up to 2.0.11. It involves an unrestricted file upload flaw (CWE-434) that allows users with editor privileges to upload arbitrary files, potentially leading to full system compromise. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
A vulnerability in the Workeera WordPress plugin before version 1.0.6 allows users with subscriber-level roles to upload arbitrary files without proper validation. This unrestricted file upload can lead to remote code execution by placing malicious files in publicly accessible directories.
A critical vulnerability (CVE-2026-77991) exists in the Joomla Event Manager (JEM) extension for Joomla versions 1.0.0 through 5.0.0. This flaw allows privileged users to upload files with dangerous types, including PHP, via the administrator source model, which can lead to remote code execution on the affected system.
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress has a critical vulnerability (CVE-2026-18080) allowing unrestricted upload of dangerous file types via the save_attachments() function. This flaw exists in all versions up to and including 1.17.8 due to missing file extension validation and path normalization when processing inbound IMAP email attachments. An unauthenticated attacker can exploit this by sending a crafted email with a malicious attachment, potentially leading to remote code execution if PHP executes in the uploads directory. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
EFence by Thinking Software Technology contains an Arbitrary File Upload vulnerability (CWE-434) that allows authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. The vulnerability has a high severity with a CVSS score of 8.8. No affected versions or patch information are provided, and no known exploits are reported in the wild.
EFence, a product by Thinking Software Technology, contains an arbitrary file upload vulnerability (CWE-434) that allows unauthenticated remote attackers to upload and execute web shell backdoors. This enables arbitrary code execution on the affected server. The vulnerability has a critical CVSS score of 9.8. No affected versions or patches have been specified yet, and no known exploits are reported in the wild.
CAYIN Technology's CMS-WS, CMS-SE, and SMP series products contain an arbitrary file upload vulnerability (CWE-434) that allows privileged remote attackers to upload and execute web shells, leading to arbitrary code execution on the server. This vulnerability has a high severity with a CVSS score of 7.2. No specific affected versions or patches are currently documented, and no known exploits are reported in the wild.
Reachy Mini SDK versions prior to 1.8.2 have an unauthenticated file upload vulnerability at the /api/media/sounds/upload endpoint. This endpoint lacks authentication, file extension checks, content validation, and size validation, allowing an attacker to upload arbitrary files. The daemon binds to all interfaces (0.0.0.0) and permits all CORS origins, increasing exposure. Uploaded files are stored in /tmp/reachy_mini_sounds/ with their original filenames. This can lead to integrity compromise of stored data and potentially serve as a foothold if combined with other vulnerabilities. The issue is fixed in version 1.8.2.
Webkul QloApps contains a vulnerability where it does not properly validate uploaded file extensions or MIME types before placing files in a publicly accessible directory. This flaw allows a remote, authenticated attacker with administrative privileges to upload executable files, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.2, indicating high severity. A fix has been implemented in commit 153ec1c, but no explicit vendor advisory or patch release version is provided.
CVE-2026-16286 is a critical vulnerability in TRtek Technological Products Software Repository Management that allows unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to the web server. This vulnerability affects versions before commit 2fb4acee. The CVSS score is 9.8, indicating high impact on confidentiality, integrity, and availability.