CVE-2026-16451: ZS-Admin Unrestricted Upload RCE Flaw

CVE-2026-16451 Overview

CVE-2026-16451 is an unrestricted file upload vulnerability in zsadmin2025 ZS-Admin, affecting commits up to b52e14536d59fda11e56e2536a1c32e82a38cead. The flaw resides in the /api/system/file/upload endpoint handled by the com.zs.file.controller.SysFileController component. Attackers can manipulate the File argument to upload arbitrary files without restriction. The issue is exploitable remotely and requires only low-privileged authentication. Public exploit details have been released, increasing the likelihood of opportunistic abuse. ZS-Admin uses a rolling release model, so no discrete affected or fixed version identifiers are published. The project was notified via a public issue report but has not responded at the time of disclosure.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the ZS-Admin file upload API, enabling potential web shell deployment and follow-on compromise of the application host.

Affected Products

zsadmin2025 ZS-Admin (rolling release up to commit b52e14536d59fda11e56e2536a1c32e82a38cead)
Component: com.zs.file.controller.SysFileController
Endpoint: /api/system/file/upload

Discovery Timeline

2026-07-21 - CVE-2026-16451 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16451

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control, manifesting as an unrestricted upload of files with dangerous types. The SysFileController.upload handler accepts multipart file input from the /api/system/file/upload endpoint without enforcing file-type, extension, or content validation. An authenticated attacker with low privileges can submit crafted multipart requests containing executable server-side payloads such as JSP, JAR, or script files. Once written to a web-accessible location, the uploaded artifact can be requested directly, resulting in arbitrary code execution in the application context. Public disclosure of the exploit lowers the barrier to abuse, and no vendor patch is currently available.

Root Cause

The root cause is missing server-side validation on the File parameter processed by com.zs.file.controller.SysFileController. The controller does not enforce an allow-list of MIME types or extensions, does not perform content inspection, and does not isolate uploaded files from executable paths. Access control on the endpoint requires only a low-privileged session, giving broad access to authenticated users of the admin platform.

Attack Vector

Exploitation is performed remotely over the network. An attacker authenticates to ZS-Admin with any low-privileged account, then issues a multipart POST request to /api/system/file/upload containing a malicious file payload. Because the controller writes the file without sanitization, the attacker can subsequently request the uploaded resource through the web server to trigger execution or use it as a staging point for lateral movement. No specific code is reproduced here; see the GitHub Issue Discussion and the VulDB CVE Details for technical references.

Detection Methods for CVE-2026-16451

Indicators of Compromise

POST requests to /api/system/file/upload from low-privileged accounts uploading files with server-executable extensions such as .jsp, .jspx, .war, .jar, .sh, or .py.
New or unexpected files appearing in ZS-Admin upload directories, especially files with double extensions or mismatched MIME types.
Outbound connections initiated by the ZS-Admin Java process shortly after upload activity.
HTTP GET requests to newly created files under upload paths originating from external IPs.

Detection Strategies

Alert on any HTTP requests to /api/system/file/upload where the uploaded filename ends in a server-interpretable extension.
Correlate upload API calls with subsequent process spawns from the Java application (for example, bash, cmd, powershell, or sh child processes).
Baseline normal upload behavior per user and flag anomalies in upload volume, file types, or destination paths.

Monitoring Recommendations

Enable verbose access logging on the ZS-Admin reverse proxy and forward logs to a centralized analytics platform for retention and searchability.
Monitor file integrity on upload directories and web-accessible paths to detect unauthorized additions in near real time.
Track authentication events for low-privileged accounts that interact with the file upload endpoint outside of expected business workflows.

How to Mitigate CVE-2026-16451

Immediate Actions Required

Restrict network access to the ZS-Admin management interface to trusted administrative networks or VPN users only.
Disable or block the /api/system/file/upload endpoint at the reverse proxy or web application firewall until a patched build is available.
Rotate credentials for all low-privileged ZS-Admin accounts and audit account provisioning for unused or unnecessary users.
Review upload directories for suspicious artifacts and remove any unauthorized files.

Patch Information

No vendor patch has been published. ZS-Admin uses a rolling release, and the maintainers have not yet responded to the GitHub Issue Discussion reporting the flaw. Track the upstream repository for commits touching com.zs.file.controller.SysFileController and rebuild once a fix is merged. Refer to the VulDB Vulnerability Record for ongoing status updates.

Workarounds

Enforce an allow-list of non-executable file extensions and MIME types at a WAF or reverse proxy layer sitting in front of ZS-Admin.
Store uploaded files outside of any web-accessible directory and serve them through a controlled download handler that sets safe Content-Type and Content-Disposition headers.
Configure the servlet container to prevent execution of scripts within upload directories, for example by removing JSP handler mappings from those paths.
Apply strict role-based access control so that only administrators can invoke the file upload API.

bash

# Example nginx configuration to block executable uploads and script execution in upload paths
location = /api/system/file/upload {
    if ($request_method = POST) {
        # Reject requests whose multipart body advertises executable extensions
        if ($http_content_disposition ~* "filename=.*\.(jsp|jspx|war|jar|sh|py|php)") {
            return 403;
        }
    }
    proxy_pass http://zsadmin_backend;
}

location ~* ^/upload/.*\.(jsp|jspx|war|jar|sh|py|php)$ {
    return 403;
}