CVE-2026-82524
Received Received - Intake

Authenticated File Upload Vulnerability in UnoPim Leading to Remote Code Execution

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-03
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-82524
EUVD
EUVD-2026-70265

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
unopim unopim to 2.1.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82524 is an authenticated file upload vulnerability in UnoPim versions before 2.1.5. It allows authenticated administrators to upload arbitrary PHP files via the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands by accessing the uploaded file at its URL.

Detection Guidance

Check for unauthorized PHP files in public storage directories, especially those uploaded via TinyMCE endpoints. Review server access logs for POST requests to /admin/tinymce/upload with non-image file extensions. Inspect file upload endpoints for missing MIME type validation. Use tools like grep to search for recently modified PHP files in web-accessible directories.

Impact Analysis

This vulnerability allows attackers with administrative access to upload and execute malicious PHP files on the server. This can lead to full system compromise, unauthorized access to sensitive files (like database credentials), privilege escalation, and potential data breaches. The impact includes remote code execution and complete control over the affected server.

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR (data protection), HIPAA (health information security), and other regulations. Organizations could face legal penalties, fines, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Upgrade UnoPim to version 2.1.5 or later immediately. Remove any unauthorized PHP files from public storage. Implement strict server-side validation for file uploads, restricting allowed extensions to images only. Store uploaded files outside the web root or use non-executable storage. Monitor for suspicious file uploads and access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart