Unrestricted File Upload in Pixtream

Executive Summary

CVE-2026-95830 is an arbitrary file upload vulnerability in the Pixtream software's post_upload.php file. Attackers can bypass security checks by modifying the Content-Type header to upload malicious files, such as webshells, disguised as images. The software only verifies user login and checks file types against a limited list but lacks robust validation.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file uploads in the /post_upload.php endpoint. Monitor for files with mismatched extensions and Content-Type headers, such as PHP files uploaded with an image/jpeg header. Inspect server logs for POST requests to /post_upload.php with unexpected file types.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to upload malicious files like PHP webshells, leading to remote code execution and full server control. It can result in unauthorized access, data theft, or disruption of business operations. Attackers may steal sensitive data or use the server for further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Disable file uploads in Pixtream if not required. Implement strict file type validation, rejecting uploads that do not match the actual file content. Use server-side checks to verify file types and block executable scripts. Restrict write permissions on the upload directory to prevent malicious file execution.

Useful 0 Not Useful 0