funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload

published 2026-05-04 6 mo ago modified 2026-06-17 4 mo ago also GHSA-qhh7-263p-54r3 , EUVD-2026-26913

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.

Patch / fix

links 1

gitee.com/funadmin/funadmin/pulls/59 patch

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-05-04)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gitee.com https://gitee.com/funadmin/funadmin/issues/IJ8NXT referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	5.5	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
packagist	funadmin/funadmin	<=7.1.0-rc6	no fix listed

Affected products

n/a funadmin

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-284 Improper Access Control

References

gitee.com /funadmin/funadmin/pulls/59
patch, web
gitee.com /funadmin/funadmin/issues/IJ8NXT
exploit, issue-tracking, web
vuldb.com /vuln/360908
vdb-entry, technical-description, web
vuldb.com /vuln/360908/cti
signature, permissions-required, web
vuldb.com /submit/807559
third-party-advisory, web
gitee.com /funadmin/funadmin/
product
nvd.nist.gov /vuln/detail/CVE-2026-7733
advisory
gitee.com /funadmin/funadmin
package

Sources

CVE List CVE-2026-7733
GitHub Advisory GHSA-qhh7-263p-54r3
NVD CVE-2026-7733

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary