CVE-2026-2113: Yuan1994 TPAdmin RCE Vulnerability

CVE-2026-2113 Overview

A security vulnerability has been detected in yuan1994 tpadmin up to version 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to insecure deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Critical Impact

Remote attackers can exploit this insecure deserialization vulnerability in the WebUploader component to potentially achieve remote code execution on affected tpadmin installations up to version 1.3.12.

Affected Products

• yuan1994 tpadmin up to version 1.3.12
• WebUploader component version 0.1.5
• /public/static/admin/lib/webuploader/0.1.5/server/preview.php

Discovery Timeline

• 2026-02-07 - CVE-2026-2113 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2113

Vulnerability Analysis

This vulnerability is classified as an insecure deserialization flaw (CWE-20: Improper Input Validation) affecting the WebUploader component in yuan1994 tpadmin. The vulnerable endpoint resides in the preview.php file located at /public/static/admin/lib/webuploader/0.1.5/server/preview.php.

The vulnerability allows remote attackers to exploit the deserialization mechanism without requiring authentication. When untrusted data is deserialized by the PHP application, an attacker can craft malicious serialized objects that, upon deserialization, can lead to arbitrary code execution, data manipulation, or other malicious outcomes.

The network-accessible nature of this vulnerability makes it particularly concerning for internet-facing tpadmin installations. The fact that this product is no longer supported by the maintainer means no official patches will be released, leaving users vulnerable indefinitely unless they implement workarounds or migrate to alternative solutions.

Root Cause

The root cause of this vulnerability lies in improper handling of serialized data in the preview.php file within the WebUploader component. The application deserializes user-supplied input without adequate validation or sanitization, allowing attackers to inject malicious serialized objects. PHP's unserialize() function, when used on untrusted data, can instantiate arbitrary objects and trigger magic methods like __wakeup() or __destruct(), leading to code execution.

Attack Vector

The attack vector for CVE-2026-2113 is network-based, requiring no authentication or user interaction. An attacker can send specially crafted HTTP requests containing malicious serialized PHP objects to the vulnerable preview.php endpoint. Upon processing, the server deserializes the malicious payload, potentially triggering object injection attacks that can lead to remote code execution.

The attacker workflow typically involves:

1. Identifying a target tpadmin installation with the vulnerable WebUploader component
2. Crafting a malicious serialized PHP object payload
3. Sending the payload to /public/static/admin/lib/webuploader/0.1.5/server/preview.php
4. Achieving code execution when the server deserializes the malicious data

For detailed technical information about this vulnerability, refer to the GitHub CVE-Report which contains the publicly disclosed exploit details.

Detection Methods for CVE-2026-2113

Indicators of Compromise

• Unusual HTTP POST requests to /public/static/admin/lib/webuploader/0.1.5/server/preview.php containing serialized PHP object patterns (e.g., O:, a:, s:)
• Web server logs showing repeated requests to the WebUploader preview endpoint from external IP addresses
• Unexpected process spawning or network connections originating from the web server process
• File system modifications in web-accessible directories following requests to the vulnerable endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP request bodies targeting the WebUploader component
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process execution chains originating from web server processes
• Configure intrusion detection systems (IDS) to alert on traffic patterns consistent with deserialization exploitation attempts
• Use SentinelOne Singularity to detect behavioral anomalies and potential code execution resulting from exploitation

Monitoring Recommendations

• Enable verbose logging for web server access to the /public/static/admin/lib/webuploader/ directory and review logs regularly for suspicious activity
• Monitor for outbound connections from the web server to unusual destinations that may indicate post-exploitation activity
• Set up alerts for any PHP process attempting to execute system commands or spawn child processes unexpectedly

How to Mitigate CVE-2026-2113

Immediate Actions Required

• Remove or disable the WebUploader component if not required for business operations by deleting or restricting access to /public/static/admin/lib/webuploader/0.1.5/server/preview.php
• Implement network-level access controls to restrict access to the vulnerable endpoint to trusted IP addresses only
• Consider migrating away from tpadmin to an actively maintained alternative, as this product is no longer supported by the maintainer
• Deploy a web application firewall with rules to block serialized PHP object injection attempts

Patch Information

This vulnerability affects yuan1994 tpadmin up to version 1.3.12. According to the vulnerability disclosure, this product is no longer supported by the maintainer, meaning no official security patch will be released. Organizations using tpadmin should implement the workarounds listed below or plan migration to an actively maintained content management solution.

For additional context and technical details, refer to VulDB #344688.

Workarounds

• Delete or rename the vulnerable preview.php file at /public/static/admin/lib/webuploader/0.1.5/server/preview.php to prevent exploitation
• Use .htaccess or web server configuration to deny all external access to the WebUploader server directory
• Implement PHP configuration changes to disable dangerous functions that could be leveraged during deserialization attacks

# Apache configuration to block access to vulnerable WebUploader component
# Add to .htaccess or virtual host configuration
<Directory "/path/to/tpadmin/public/static/admin/lib/webuploader">
    Order Deny,Allow
    Deny from all
    # Optionally allow specific trusted IPs
    # Allow from 192.168.1.0/24
</Directory>

# Alternative: Rename or remove the vulnerable file
mv /path/to/tpadmin/public/static/admin/lib/webuploader/0.1.5/server/preview.php /path/to/tpadmin/public/static/admin/lib/webuploader/0.1.5/server/preview.php.disabled