CVE-2026-82921

Received Received - Intake

Unrestricted File Upload in ShopEx ECShop

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82921

EUVD

EUVD-2026-68885

Affected Vendors & Products

Vendor	Product	Version / Range
shopex	ecshop	to 2.5.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ShopEx ECShop versions up to 2.5.1. It involves a weakness in the check_img_type function of the admin/pack.php file. An attacker can manipulate the pack_img argument to bypass file type restrictions, enabling unrestricted file uploads. The exploit is publicly available and can be executed remotely.

Detection Guidance

Detecting this vulnerability requires checking for unrestricted file uploads in ShopEx ECShop versions up to 2.5.1. Inspect the admin/pack.php file for improper validation of the pack_img argument in the check_img_type function. Look for unexpected file uploads or executable files in web-accessible directories.

Impact Analysis

This vulnerability allows remote attackers to upload malicious files to the server. This could lead to remote code execution, malware distribution, or unauthorized access to sensitive data. Systems running vulnerable versions of ShopEx ECShop are at risk of compromise.

Compliance Impact

This vulnerability allows unrestricted file uploads due to improper validation in ShopEx ECShop, which could lead to execution of malicious files. For GDPR, this may violate data integrity and security requirements under Articles 32 and 5. For HIPAA, it risks unauthorized access to protected health information, potentially violating the Security Rule.

Mitigation Strategies

Immediately upgrade ShopEx ECShop to a version beyond 2.5.1 if available. If no patch exists, consider disabling the affected function or restricting access to admin/pack.php. Monitor network traffic for unusual file uploads or suspicious activity.

Hi! I’m here to help you understand CVE-2026-82921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70