CVE-2026-11621
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to remote code execution or website defacement.
Recommendation
Update Dcat-Admin to the latest version and restrict file upload functionality to trusted users only.
Other vulnerabilities in Dcat-Admin
See all- CVE-2024-29644Medium
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
- CVE-2023-33736Medium
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
Original NVD description (English source)
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.