Threat database

CVE-2026-116113 is a medium severity vulnerability in GouGuOA versions 6.1.0, 6.1.1, and 6.1.2. It involves an unrestricted file upload flaw in the chunkUpload function of app/disk/controller/Api.php, where manipulation of the file_extension argument allows remote attackers to upload arbitrary files. Public exploit code has been released, and the vendor has not responded to disclosure attempts.

GouGuOA versions 6.0.5 and earlier contain a critical SQL Injection vulnerability in the /home/message/rubbish endpoint via the keywords parameter. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.