CVE-2026-10072: DreamMaker Arbitrary File Upload RCE Flaw

CVE-2026-10072 Overview

CVE-2026-10072 is an arbitrary file upload vulnerability in DreamMaker, a product developed by Interinfo. The flaw allows authenticated remote attackers with high privileges to upload web shell backdoors to the server. Once uploaded, the attacker can execute the web shell to run arbitrary code in the context of the web application. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type and was reported through Taiwan's CERT coordination process.

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the underlying server, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

DreamMaker by Interinfo
Specific affected versions were not enumerated in the published advisory
Refer to the TW CERT Security Advisory for vendor-confirmed version data

Discovery Timeline

2026-05-29 - CVE-2026-10072 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10072

Vulnerability Analysis

The vulnerability stems from missing or insufficient validation of files uploaded through an authenticated interface in DreamMaker. The application accepts files without enforcing restrictions on file extension, MIME type, or content. An attacker holding privileged credentials can upload a server-side script, such as a PHP, ASP, or JSP web shell, into a directory served by the web stack. When the attacker requests the uploaded file, the web server interprets it as executable code rather than as a static asset.

This behavior places the flaw in the CWE-434 category. Because execution occurs server-side, the attacker inherits the privileges of the web application process and can run operating system commands, pivot to internal systems, or stage further payloads. The advisory confirms full impact to confidentiality, integrity, and availability of the host system.

Root Cause

The root cause is the absence of a strict allowlist for permitted file types combined with the application writing uploaded files into a directory configured for script execution. Server-side handlers do not validate file content against extension, and the upload endpoint does not strip or rewrite dangerous extensions before persistence.

Attack Vector

The attack is performed over the network against the DreamMaker management interface. The attacker must first authenticate with high privileges, then submit a crafted upload request containing a web shell payload. After upload, the attacker issues an HTTP request to the resulting file path, triggering server-side execution. The vulnerability mechanism is detailed in the TW CERT Incident Report.

Detection Methods for CVE-2026-10072

Indicators of Compromise

Unexpected files with executable extensions such as .php, .asp, .aspx, .jsp, or .jspx appearing inside DreamMaker upload directories.
Web server access logs showing POST requests to upload endpoints followed by GET requests to newly created files with executable extensions.
Outbound network connections from the DreamMaker host to unfamiliar IP addresses shortly after a successful upload event.
Child processes such as cmd.exe, powershell.exe, /bin/sh, or bash spawned by the web server process hosting DreamMaker.

Detection Strategies

Hunt for web shell signatures in upload directories using file integrity monitoring and YARA rules targeting common shells such as China Chopper, Behinder, and Godzilla.
Correlate authentication events for privileged DreamMaker accounts with subsequent file upload and file execution requests in web logs.
Alert on web server processes that execute interactive shells or reconnaissance commands such as whoami, net user, or ipconfig.

Monitoring Recommendations

Enable verbose access and application logging on the DreamMaker web server and forward logs to a central analytics platform.
Monitor changes to web root and upload directories with file integrity monitoring configured for real-time alerting.
Track privileged account activity, including login source, session duration, and administrative actions on the DreamMaker console.

How to Mitigate CVE-2026-10072

Immediate Actions Required

Apply the vendor-supplied patch referenced in the TW CERT Security Advisory as soon as it is available for your deployment.
Restrict network access to the DreamMaker management interface to trusted administrative networks only.
Rotate credentials for all privileged DreamMaker accounts and audit account membership for unauthorized additions.
Inspect upload directories and web logs for evidence of prior exploitation and remove any unauthorized files.

Patch Information

Interinfo has coordinated remediation through TW CERT. Administrators should consult the TW CERT Security Advisory for the fixed version and update instructions. Apply the patch on all DreamMaker instances and verify the upload handler enforces extension and content validation after upgrade.

Workarounds

Place the DreamMaker upload directory on a filesystem path that the web server is configured to serve as static content only, disabling script execution for that location.
Enforce multi-factor authentication on privileged accounts to reduce the likelihood of credential abuse leading to exploitation.
Deploy a web application firewall rule that blocks uploads of files with server-executable extensions to the DreamMaker upload endpoint.

bash

# Example Apache configuration disabling script execution in upload directory
<Directory "/var/www/dreammaker/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    Options -ExecCGI
    RemoveHandler .php .phtml .cgi .pl
</Directory>