CVE-2026-82524
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary OS commands on the server.
Risk Assessment
An authenticated attacker can gain full control of the server, potentially leading to data confidentiality and integrity breaches and further attacks.
Recommendation
Update UnoPim to version 2.1.5 or later and restrict administrator privileges to the minimum.
Other vulnerabilities in UnoPim
See all- CVE-2026-102630Medium
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
- CVE-2026-85395High
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Original NVD description (English source)
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS