CVE-2026-6847
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A remote code execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. An unauthenticated attacker can upload arbitrary PHP files by providing a base64-encoded payload and execute arbitrary code on the server. The issue has been fixed in a patch released in April 2026.
Risk Assessment
The risk for the organization includes full server compromise, potentially leading to data theft, malware installation, or using the server for further attacks.
Recommendation
It is recommended to immediately apply the patch released in April 2026 and implement authentication for all file upload functions in ThemisNETPanel.
Original NVD description (English source)
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.