Vulnerability · Published Jul 21, 2026 · Assigned by VulDB

CVE-2026-16330D-Link DNS-320 uploadify.php unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in DNS-320 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)1.6%top 24.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
D-Link	DNS-320	1.0.2

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-380696 | D-Link DNS-320 uploadify.php unrestricted upload vdb-entry, technical-description
VDB-380696 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-16330 | CVE Analysis and Report third-party-advisory
Submit #858463 | D-Link (Shanghai)Limited Corp. D-Link DNS32 1.0.2 CWE-434 (Unrestricted Upload of File with Dangerous Type) third-party-advisory
https://ucn9h68n9289.feishu.cn/docx/EkMxdLlavojfsXxzKXec5yUknEg?from=from_copylink exploit
https://www.dlink.com/ product