CVE-2026-6847: ThemisNETPanel RCE Vulnerability

CVE-2026-6847 Overview

CVE-2026-6847 is an unauthenticated remote code execution (RCE) vulnerability in ThemisNETPanel. The application exposes a file upload endpoint that requires no authentication. An attacker submits a base64-encoded payload, which the server decodes and writes as an arbitrary PHP file. The attacker then requests the uploaded file to execute code in the context of the web server process. The issue is tracked under CWE-306: Missing Authentication for Critical Function. A vendor patch was released in April 2026.

Critical Impact
Unauthenticated network attackers can upload arbitrary PHP files and execute code on the underlying server, resulting in full system compromise.

Affected Products

ThemisNETPanel (versions prior to the April 2026 patch)

Discovery Timeline

2026-07-13 - CVE-2026-6847 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-6847

Vulnerability Analysis

ThemisNETPanel exposes an HTTP endpoint that accepts a base64-encoded file payload from unauthenticated clients. The handler decodes the payload and writes the resulting content to a location served by the PHP interpreter. Because the endpoint enforces no authentication, session validation, or file-type restriction, an attacker can plant a PHP web shell without holding any credentials. Subsequent HTTP requests to the uploaded file trigger interpretation by the PHP runtime, producing arbitrary command execution. Successful exploitation grants control over the panel, hosted data, and any downstream systems the application can reach.

Root Cause

The root cause is a missing authentication check on a security-critical file upload function, classified as [CWE-306]. The endpoint trusts any inbound request that supplies a base64 payload. There is no server-side allowlist for extensions, MIME types, or upload directories that would prevent the resulting file from being interpreted as PHP.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker locates a reachable ThemisNETPanel instance, submits an HTTP request containing a base64-encoded PHP payload to the vulnerable upload endpoint, and then issues a follow-up request to the resulting file path to execute code. Refer to the CERT Polska advisory for CVE-2026-6847 for protocol-level detail. No public proof-of-concept exploit is listed in NVD at the time of writing.

Detection Methods for CVE-2026-6847

Indicators of Compromise

Unauthenticated POST requests to ThemisNETPanel upload endpoints carrying large base64-encoded request bodies.
New or unexpected .php files appearing in ThemisNETPanel web-accessible directories, especially with recent timestamps.
Web server child processes spawning shell interpreters such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections from the ThemisNETPanel host to unfamiliar IP addresses shortly after an upload request.

Detection Strategies

Alert on HTTP request bodies to ThemisNETPanel that contain base64 strings decoding to PHP tags such as <?php or <?=.
Monitor file integrity on the ThemisNETPanel web root and flag creation of files with executable extensions.
Correlate web access logs with process creation events to identify web-shell style command execution chains.

Monitoring Recommendations

Forward ThemisNETPanel web server and application logs to a centralized SIEM for retention and correlation.
Establish a baseline of legitimate administrative activity so that anonymous or off-hours upload attempts stand out.
Track egress traffic from the panel host to identify reverse-shell or data-exfiltration behavior post-exploitation.

How to Mitigate CVE-2026-6847

Immediate Actions Required

Apply the April 2026 ThemisNETPanel patch on all instances without delay.
Restrict network access to the panel to trusted administrative networks or VPNs until patching is confirmed.
Audit web-accessible directories for unauthorized PHP files and remove any that cannot be attributed to legitimate deployments.
Rotate credentials, API keys, and secrets stored on or accessible from any potentially compromised host.

Patch Information

The vendor released a fix in April 2026 that adds authentication enforcement to the affected upload function. Administrators should upgrade to the patched build referenced in the CERT Polska advisory and verify the version string after upgrading.

Workarounds

Block external access to the upload endpoint at the reverse proxy or web application firewall until the patch is applied.
Disable PHP execution in upload and temporary directories using web server configuration.
Enforce network segmentation so the ThemisNETPanel host cannot initiate arbitrary outbound connections.

bash

# Example nginx configuration to block PHP execution in an uploads directory
location ^~ /uploads/ {
    location ~ \.php$ {
        deny all;
        return 403;
    }
}