CVE-2026-82524: UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated UnoPim administrator can exploit it. The attacker needs access to the TinyMCE image upload functionality and can upload a PHP web shell through that endpoint.
Are installations affected by default?
The issue is present in UnoPim versions before 2.1.5 because the TinyMCE image upload endpoint lacks file-extension and MIME-type validation. Successful exploitation also requires uploaded files on the public storage disk to be accessible through the URL returned by the server.
What is the impact after a successful upload?
The attacker can access the uploaded PHP file and execute arbitrary operating system commands on the server. This can compromise confidentiality, integrity, and availability.
What should teams do if they cannot immediately upgrade?
Restrict administrator access and prevent untrusted or unnecessary users from accessing the TinyMCE image upload endpoint. Review files uploaded to the public storage disk and investigate unexpected PHP files or URLs returned by image-upload requests.