Unrestricted File Upload in GouGuOA Application

Executive Summary

CVE-2026-116113 is a vulnerability in GouGuOA up to version 6.1.2 that allows unrestricted file uploads. The flaw is in the chunkUpload function of app/disk/controller/Api.php, where the file_extension parameter is manipulated to bypass security checks. This leads to remote code execution (RCE) because malicious PHP files can be uploaded and executed from a web-accessible directory.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in web-accessible directories like public/storage. Monitor POST requests to /disk/api/chunkUpload with unusual file extensions. Review logs for multipart uploads containing PHP payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to an authenticated employee account could exploit this to upload and execute arbitrary PHP code on the server. This could lead to full system compromise, data theft, or further network infiltration. The impact is significant as it affects default installations and requires only basic authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using GouGuOA may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the chunkUpload endpoint if possible. Enforce strict file extension whitelists. Move storage directories outside the web root. Apply patches from the vendor if available. Scan for and remove any suspicious PHP files in public directories.

Useful 0 Not Useful 0