CVE-2026-108688: Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated Eladmin user can exploit it. The attacker does not need the storage:add permission that would normally govern this upload capability.
What access and request are required for exploitation?
The attacker needs valid authentication and network access to the Eladmin API. They can send a POST request containing an image-named file to /api/localStorage/pictures.
What is the impact of a successful exploit?
An attacker can write files into the server's local storage through the affected upload handler. The response can also disclose absolute paths on the server.
Are unauthenticated deployments affected?
The provided information identifies exploitation by authenticated low-privileged users, so authentication is required for the described attack. It does not establish whether any particular default configuration exposes such user accounts.