CVE-2026-4337: Unrestricted Upload of File in PuMuKIT application
Published Oct 27, 2026
·Updated
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
Affected Software
1 affected component
PuMuKIT PuMuKIT
Event History
Oct 27, 2026
CVE Published
via MITRE·11:03 AM
Data Sourced
via MITRE·11:03 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated user can exploit it. No login or prior account access is described as necessary.
2
What level of server access could a successful attacker obtain?
The attacker can upload files of any type to locations writable by the web server user. The issue could also allow deletion of files in locations where that user has write permissions.
3
What determines which paths are at risk?
Exposure is limited by the write permissions of the web server user. Any directory writable by that account may be a potential upload or deletion target.