CVE-2025-15426: H-ui.admin Unrestricted Upload RCE Flaw

CVE-2025-15426 Overview

A vulnerability was identified in jackying H-ui.admin up to version 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted file upload, enabling attackers to upload malicious files to the server. The attack is possible to be carried out remotely over the network. The exploit is publicly available and may be actively used. The vendor was contacted early about this disclosure but did not respond in any way.

Critical Impact

Unrestricted file upload vulnerabilities can allow attackers to upload malicious PHP scripts or web shells, potentially leading to remote code execution and complete server compromise.

Affected Products

• H-ui.admin up to version 3.1
• WebUploader component version 0.1.5

Discovery Timeline

• 2026-01-02 - CVE-2025-15426 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2025-15426

Vulnerability Analysis

This vulnerability is classified as an Unrestricted File Upload vulnerability (CWE-284: Improper Access Control). The vulnerable component resides in the preview.php file within the WebUploader library at /lib/webuploader/0.1.5/server/preview.php. The vulnerability allows remote attackers to upload arbitrary files without proper validation or restriction, which can lead to remote code execution if executable files such as PHP scripts are uploaded and subsequently accessed.

The lack of proper file type validation and access controls in the upload functionality creates a significant security risk. An attacker can exploit this weakness to upload malicious files that, when executed by the web server, provide unauthorized access to the underlying system.

Root Cause

The root cause of this vulnerability is improper access control (CWE-284) in the file upload functionality. The preview.php script fails to properly validate and restrict the types of files that can be uploaded, the destination paths where files can be written, and the authentication or authorization of users attempting to upload files. This lack of validation allows attackers to bypass intended security controls and upload arbitrary content to the server.

Attack Vector

The attack can be executed remotely over the network without requiring any prior authentication. An attacker can craft a malicious HTTP request to the vulnerable preview.php endpoint, uploading a specially crafted file (such as a PHP web shell). Once uploaded, the attacker can access the uploaded file through the web server to execute arbitrary commands on the target system.

The network-based attack vector with no authentication requirements makes this vulnerability particularly dangerous, as any attacker with network access to the vulnerable application can potentially exploit it.

Detection Methods for CVE-2025-15426

Indicators of Compromise

• Unexpected files appearing in upload directories, particularly with .php, .phtml, or other executable extensions
• Web server logs showing POST requests to /lib/webuploader/0.1.5/server/preview.php from unknown or suspicious IP addresses
• Presence of web shells or backdoor scripts in publicly accessible directories
• Unusual outbound network connections from the web server

Detection Strategies

• Monitor web server access logs for requests to the vulnerable endpoint /lib/webuploader/0.1.5/server/preview.php
• Implement file integrity monitoring on upload directories to detect unauthorized file creation
• Deploy web application firewalls (WAF) with rules to detect and block malicious file upload attempts
• Use endpoint detection and response (EDR) solutions to identify suspicious process execution originating from web server directories

Monitoring Recommendations

• Enable detailed logging for all file upload operations and review logs regularly for anomalies
• Configure alerts for file creation events in web-accessible directories, especially for executable file types
• Monitor for unusual web server child processes that may indicate web shell execution
• Implement network monitoring to detect command-and-control communications from compromised servers

How to Mitigate CVE-2025-15426

Immediate Actions Required

• Remove or disable the vulnerable preview.php file immediately if not required for application functionality
• Implement strict file type validation allowing only explicitly permitted file extensions
• Restrict access to the upload endpoint through authentication and IP whitelisting
• Review upload directories for any suspicious files that may have been uploaded through exploitation

Patch Information

No official patch is currently available from the vendor. The vendor was contacted regarding this vulnerability but did not respond. Organizations using H-ui.admin should implement the workarounds described below until a patch becomes available. For technical details, refer to the GitHub CVE Report and VulDB entry.

Workarounds

• Delete or rename the vulnerable /lib/webuploader/0.1.5/server/preview.php file if it is not essential
• Implement server-side file type validation that checks file content (magic bytes) rather than relying solely on file extensions
• Configure the web server to prevent execution of scripts in upload directories using directives such as php_flag engine off
• Use .htaccess or equivalent server configuration to restrict access to the upload handler

# Apache configuration to disable PHP execution in upload directories
# Add to .htaccess or virtual host configuration
<Directory "/var/www/html/lib/webuploader/0.1.5/server/">
    php_flag engine off
    <FilesMatch "\.(php|phtml|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>