CVE-2026-82524highCWE-434

CVE-2026-82524: falha de alta gravidade em unopim

UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar unopim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.6epss 0.6%
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
unopim · unopim
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — unopim

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55745LOWUnoPim Quick Export feature is vulnerable to CSV injectionEPSS 0.6%CVE-2025-55743HIGHUnoPim vulnerable to remote code execution through Arbitrary File uploadEPSS 0.5%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2025-55742HIGHUnoPim Stored XSS via SVG MIME/Sanitizer BypassEPSS 0.4%CVE-2024-52305MEDIUMUnoPim Stored XSS : Cookie hijacking through Create User functionEPSS 0.2%