CVE-2026-113382: arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
arizu-id fast-tunnelto a version that resolves this vulnerability.Fixed in 1.0.1Patch 04573681420295f7b327c9da3b101aed2f3cf432
Event History
Frequently Asked Questions
Which deployments are affected?
arizu-id fast-tunnel version 1.0.0 is affected. Upgrading to version 1.0.1 resolves the issue.
What access does an attacker need?
The attack can be launched remotely, but the supplied vector specifies low privileges are required. No user interaction is required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should be done if the affected version is in use?
Upgrade the Plugin Installer component to fast-tunnel 1.0.1. The vendor patch is identified as 04573681420295f7b327c9da3b101aed2f3cf432.