CVE-2026-6650: Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload
A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6650?
CVE-2026-6650 is classified as a high severity vulnerability due to its potential for unrestricted file uploads.
How do I fix CVE-2026-6650?
To fix CVE-2026-6650, update Z-BlogPHP to version 1.7.6 or later, which addresses this vulnerability.
What are the potential impacts of CVE-2026-6650?
CVE-2026-6650 can lead to arbitrary file uploads, potentially allowing attackers to execute malicious code on the server.
In which software versions is CVE-2026-6650 found?
CVE-2026-6650 affects Z-BlogPHP version 1.7.5.
Is there a proof of concept for CVE-2026-6650?
Yes, researchers may have demonstrated a proof of concept for CVE-2026-6650, illustrating its exploitation potential.