CVE-2026-84063
Deferred Deferred - Pending Action

Unrestricted File Upload in BurgerEditor

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: JPCERT/CC

Description
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-84063
EUVD
EUVD-2026-75229

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
burgereditor burgereditor From 3.2.0 (inc) to 3.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BurgerEditor 3.2.0 through 3.4.0 has an issue where users with login access can upload files without proper restrictions. This allows attackers to upload dangerous file types, which may lead to arbitrary PHP code execution on the server.

Detection Guidance

Check for unauthorized file uploads in BurgerEditor directories, particularly files with .php, .phtml, or other executable extensions. Inspect web server logs for suspicious POST requests to BurgerEditor upload endpoints. Verify if .htaccess files are missing in upload directories, which could indicate exploitation attempts.

Impact Analysis

An attacker with login access could upload malicious files, potentially altering website content or executing harmful code. This could lead to unauthorized access, data breaches, or defacement of the website.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Update BurgerEditor to version 3.4.1 or 2.30.1 immediately. Enable the new configuration setting to block executable file extensions. Ensure .htaccess files are deployed to restrict direct access to uploaded files. Review and remove any suspicious files in upload directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart