CVE-2026-32559

Received Received - Intake

Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description

Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-32559

Affected Vendors & Products

Vendor	Product	Version / Range
ultimateai	subscriber_arbitrary_file_upload	to 3.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the UltimateAI plugin versions 3.1.0 and below. It allows subscribers to upload arbitrary files due to insufficient restrictions. This could let attackers upload malicious files to the server.

Impact Analysis

An attacker could exploit this to upload harmful files, potentially leading to remote code execution, data theft, or server compromise. It may also allow unauthorized access to sensitive information or disruption of services.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update UltimateAI Subscriber to a version higher than 3.1.0 to patch the arbitrary file upload vulnerability. If an update is not available, consider disabling the plugin or restricting access to vulnerable endpoints until a fix is applied.

Hi! I’m here to help you understand CVE-2026-32559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70