CVE-2026-84063
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of files with dangerous types. If exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code execution.
Risk Assessment
An attacker with an application account can upload a malicious file and achieve arbitrary PHP code execution, risking full server takeover.
Recommendation
Update BurgerEditor to a patched version, restrict allowed upload file types, and disable script execution in the upload directory.
Other vulnerabilities in BurgerEditor
Original NVD description (English source)
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS