Log in Start free

Vulnerability · Published May 4, 2026 · Assigned by VulDB

CVE-2026-7733funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in funadmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 77.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistfunadmin/funadminno fix listedGHSA-qhh7-263p-54r3

Affected products (as reported)

VendorProductVersions
n/a funadmin 7.1.0-rc17.1.0-rc27.1.0-rc37.1.0-rc47.1.0-rc57.1.0-rc6

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References