Executive Summary

CVE-2026-2898 is a deserialization vulnerability in funadmin versions up to 7.1.0-rc4, specifically in the getMember function of the file app/common/service/AuthCloudService.php within the Backend Endpoint component.

The vulnerability occurs because the argument cloud_account, which comes from user-controlled cookie data, is deserialized without proper validation. This unsafe deserialization allows attackers to supply malicious serialized data.

Exploitation can be performed remotely and requires some user interaction. Attackers can leverage gadget chains from the League Flysystem dependency to perform arbitrary file writes on the server, potentially leading to remote code execution.

The vulnerability affects several backend endpoints that invoke getMember(), including upgrade and addon related endpoints. The vendor was notified but did not respond or provide any mitigation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability impacts the confidentiality, integrity, and availability of the affected system.

An attacker can exploit this flaw to write arbitrary files on the server, including malicious PHP code, which can lead to remote code execution.

Successful exploitation allows an attacker to fully compromise the backend system without requiring authentication, potentially taking control over the application and its data.

The exploit is publicly available and can be triggered remotely, increasing the risk of attacks.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying the presence of the vulnerable funadmin versions (up to 7.1.0-rc4) and specifically the vulnerable function getMember in the file app/common/service/AuthCloudService.php.

One detection method is to use Google dorking techniques to find exposed endpoints that include the vulnerable file, for example by searching for inurl:app/common/service/AuthCloudService.php.

On your system or network, you can check for requests or traffic targeting the following backend endpoints that invoke the vulnerable getMember function:

• /backend/addon/index
• /backend/sys/upgrade/index
• /backend/sys/upgrade/check
• /backend/sys/upgrade/backup
• /backend/sys/upgrade/install

Additionally, monitoring for suspicious cookies named cloud_account containing serialized data or unusual payloads may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

There are no known patches or vendor-provided mitigations for this vulnerability as the vendor did not respond to the disclosure.

Immediate mitigation steps include considering replacing the affected product or component (funadmin versions up to 7.1.0-rc4) with a secure alternative.

In the short term, restrict access to the vulnerable backend endpoints to trusted users only and monitor for suspicious activity targeting these endpoints.

Implement network-level protections such as web application firewalls (WAFs) to detect and block malicious serialized payloads or exploitation attempts involving the cloud_account cookie.

Avoid user interaction with untrusted sources that might trigger the vulnerability, as exploitation requires some user interaction.

Useful 0 Not Useful 0