CVE-2026-16451
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Unrestricted file upload vulnerability in ZS-Admin up to version b52e145. An unknown function in /api/system/file/upload in the SysFileController component does not restrict the uploaded file type, allowing remote upload of arbitrary files. The exploit is public.
Risk Assessment
An attacker can upload a malicious file (e.g., webshell) to the server, leading to remote code execution and full system compromise.
Recommendation
Immediately update ZS-Admin to the latest version or manually add file type validation and size restrictions in the upload function.
Other vulnerabilities in ZS-Admin
See all- CVE-2026-16450Medium
Vulnerability in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The getTenantId function in /api/system/sys/dept/page of the MyBatis-Plus Tenant Plugin allows authorization bypass via manipulation of the X-Tenant-Id argument. Remote attack, exploit publicly available.
- CVE-2026-16449Medium
In ZS-Admin up to version b52e14536d59fda11e56e2536a1c32e82a38cead, the function OrderItem.asc/OrderItem.desc in file /api/system/sys/dept/page of component com.zs.sys.dept.controller.SysDeptController is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be carried out remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.