CVE-2026-7733
HighSummary
A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.
Risk Assessment
The attack can be carried out remotely, posing a serious security risk to the system. The publication of the exploit increases the likelihood of this vulnerability being exploited.
Recommendation
It is recommended to deploy patch 59 to fix this issue.
Other vulnerabilities in funadmin
See all- CVE-2026-121610High
A security flaw was discovered in funadmin 7.1.0 in the Curd::selectList function of /frontend/ajax/index (Frontend List Endpoint component). Manipulating the selectFields argument results in SQL injection. The attack can be executed remotely and the exploit has been released publicly.
- CVE-2023-36097Critical
Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.
Original NVD description (English source)
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS