CVE-2026-108688
Received Received - Intake

Missing Authorization in Eladmin LocalStorageController Allows File Upload

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108688
EUVD
EUVD-2026-96713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elunez eladmin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in Eladmin version 2.7 or earlier. It allows low-privileged authenticated users to bypass the required storage:add permission and upload files to the server's local storage by sending POST requests with image-named files to the /api/localStorage/pictures endpoint. This can lead to unauthorized file writes and potential disclosure of absolute server paths.

Detection Guidance

Check for unauthorized POST requests to /api/localStorage/pictures endpoint. Monitor file uploads in the tool_local_storage directory. Review logs for requests from low-privileged users attempting to upload image files.

Impact Analysis

An attacker could exploit this to upload malicious files to the server, potentially leading to remote code execution, data theft, or further compromise of the system. The vulnerability also exposes server directory structures, aiding in reconnaissance for additional attacks.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to server storage, potentially leading to data breaches. GDPR and HIPAA require strict access controls and protection of sensitive data, which this flaw undermines by permitting unauthorized file uploads.

Mitigation Strategies

Apply the latest eladmin patch if available. Add @PreAuthorize("storage:add") annotations to LocalStorageController.java and LocalStorageServiceImpl.java. Restrict write permissions to the tool_local_storage directory. Monitor for suspicious file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart