CVE-2026-7733: funadmin Unrestricted Upload RCE Vulnerability

CVE-2026-7733 Overview

CVE-2026-7733 is an unrestricted file upload vulnerability in funadmin versions up to 7.1.0-rc6. The flaw resides in the UploadService::chunkUpload function within app/common/service/UploadService.php, which handles the Frontend Chunked Upload Endpoint. Attackers can manipulate the File argument to bypass upload restrictions and place arbitrary files on the server. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact

Remote attackers can upload arbitrary files to vulnerable funadmin instances through the chunked upload endpoint, potentially leading to web shell deployment and server compromise.

Affected Products

• funadmin versions up to and including 7.1.0-rc6
• Component: app/common/service/UploadService.php
• Frontend Chunked Upload Endpoint (UploadService::chunkUpload)

Discovery Timeline

• 2026-05-04 - CVE-2026-7733 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7733

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control and manifests as an unrestricted file upload condition. The chunkUpload function in UploadService.php accepts a File argument from the Frontend Chunked Upload Endpoint without sufficient validation of file type, extension, or content. Attackers leverage this gap to push files of their choosing to the application's upload directory.

Chunked upload endpoints typically reassemble file fragments into a final artifact on the server. When validation occurs only on individual chunks rather than the reconstructed file, attackers can submit chunks that combine into executable payloads. This pattern is common in PHP applications where uploaded files within the web root can be requested directly through the web server.

Root Cause

The root cause lies in missing or insufficient access control checks in UploadService::chunkUpload. The function does not enforce restrictions on the File parameter, allowing arbitrary file extensions and MIME types to pass through. Without server-side validation against an allow-list of permitted file types, the endpoint accepts any content the client supplies.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted multipart requests to the chunked upload endpoint, supplying a malicious File parameter. Upon successful upload, the attacker requests the file via its predictable path to trigger execution. The publicly available exploit lowers the barrier for unauthenticated remote attackers to compromise vulnerable deployments.

The vulnerability mechanism is described in the Gitee FunAdmin Issue IJ8NXT and VulDB Vulnerability #360908. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-7733

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .phar) in funadmin upload directories
• HTTP POST requests to the chunked upload endpoint from unauthenticated sources or unusual IP ranges
• New or modified files in app/common/service/ upload destinations not associated with administrative activity
• Outbound connections originating from the web server process following upload events

Detection Strategies

• Inspect web server access logs for POST requests targeting the chunked upload route, correlating timestamps with file system changes in upload directories
• Deploy file integrity monitoring on funadmin upload paths to flag creation of files with server-side executable extensions
• Apply web application firewall rules to block multipart uploads containing PHP tags or executable MIME types to the chunked endpoint

Monitoring Recommendations

• Continuously monitor process trees spawned by the PHP-FPM or web server user for shell execution following upload activity
• Alert on first-seen file hashes appearing in publicly accessible upload directories
• Track HTTP response patterns where uploaded filenames are subsequently requested via GET, indicating possible web shell access

How to Mitigate CVE-2026-7733

Immediate Actions Required

• Restrict network access to the funadmin application to trusted users until a patched version is deployed
• Audit upload directories for unauthorized files and remove any artifacts that do not correspond to legitimate administrative uploads
• Disable PHP execution within upload directories using web server configuration to neutralize uploaded web shells

Patch Information

The maintainers addressed the issue in patch reference 59. Review the Gitee FunAdmin Pull Request #59 for the upstream fix and apply the corresponding update from the Gitee FunAdmin Repository. Operators running funadmin 7.1.0-rc6 or earlier should upgrade to the patched release.

Workarounds

• Implement an allow-list of permitted file extensions and validate the reconstructed file after chunk reassembly, not only individual chunks
• Configure the web server to deny script execution in upload directories using directives such as php_admin_flag engine off for Apache or location-based handler restrictions for Nginx
• Place the chunked upload endpoint behind authentication and rate limiting via a reverse proxy or WAF until the patch is applied

# Nginx configuration to block PHP execution in upload directory
location ~* /uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}