Vulnerability · Published Jun 9, 2026 · Assigned by VulDB

CVE-2026-11621Dcat-Admin User Setting upload editorMDUpload unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in Dcat-Admin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
n/a	Dcat-Admin	2.2.3-beta

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-369302 | Dcat-Admin User Setting upload editorMDUpload unrestricted upload vdb-entry, technical-description
VDB-369302 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-11621 | CVE Analysis and Report third-party-advisory
Submit #834849 | Dcat-Admin <2.2.2-beta Unrestricted Upload third-party-advisory
https://www.yuque.com/u25169484/wroc9b/co6eg4x23xkfesng exploit