Vulnerability · Published Oct 20, 2026 · Assigned by VulDB
CVE-2026-113382arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
Medium 6.3
In plain English
A medium-severity unrestricted file upload in fast-tunnel from arizu-id. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| arizu-id | fast-tunnel | 1.0.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-422655 | arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload vdb-entry, technical-description
- VDB-422655 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-113382 | CVE Analysis and Report third-party-advisory
- Submit #990501 | arizu-id fast-tunnel v1.0.0 Unrestricted Upload of File with Dangerous Type — CWE-434 third-party-advisory
- https://github.com/arizu-id/fast-tunnel/commit/04573681420295f7b327c9da3b101aed2f3cf432 patch
- https://github.com/arizu-id/fast-tunnel/releases/tag/1.0.1 patch
- https://github.com/arizu-id/fast-tunnel/ product