CVE-2026-80050: ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it; the available data does not indicate that administrative privileges or file-upload permissions are required. Exploitation is network-accessible and requires no user interaction.
What does an attacker need to do to exploit it?
The attacker must authenticate to the application, initialize a chunked multipart upload, submit file parts, and complete the upload. This can store a file with an arbitrary extension in the backend storage where it is accessible through web server URLs.
What is the likely impact of successful exploitation?
Successful exploitation allows unauthorized storage of arbitrary file types and can compromise integrity. The provided information does not establish that uploaded files are executed by the server or that confidentiality or availability are affected.
Which versions are known to be affected?
ContiNew Admin through version 4.1.0 is identified as affected. The provided data does not specify a fixed version.