CVE-2026-7733

High

Published: 04/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.

Risk Assessment

The attack can be carried out remotely, posing a serious security risk to the system. The publication of the exploit increases the likelihood of this vulnerability being exploited.

Recommendation

It is recommended to deploy patch 59 to fix this issue.

Other vulnerabilities in funadmin

CVE-2023-36097Critical
Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.

Original NVD description (English source)

A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.