CVE-2026-116113
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A security flaw was discovered in GouGuOA up to version 6.1.2 in the chunkUpload function of app/disk/controller/Api.php. Manipulating the file_extension argument results in unrestricted file upload. A public exploit is available and can be used for remote attacks.
Risk Assessment
A remote attacker could upload arbitrary files, including executable scripts, potentially leading to server compromise. This poses a serious risk to the confidentiality and integrity of organizational data.
Recommendation
Update GouGuOA to a patched version as soon as possible or restrict access to the file upload functionality. Implement server-side file extension validation and monitor for unusual uploaded files.
Other vulnerabilities in GouGuOA
See all- CVE-2026-88395Critical
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
- CVE-2026-84430Medium
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue.
Original NVD description (English source)
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS