CVE-2026-82524: UnoPim File Upload RCE Vulnerability

CVE-2026-82524 Overview

CVE-2026-82524 is an authenticated file upload vulnerability in UnoPim versions before 2.1.5. The flaw resides in the TinyMCE image upload endpoint, which fails to validate file extensions and MIME types. Authenticated administrators can upload arbitrary PHP files to the public storage disk. Attackers then execute operating system commands by requesting the uploaded web shell at the URL returned in the server response. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrator can achieve remote code execution on the underlying server, leading to full compromise of the UnoPim application and host.

Affected Products

UnoPim versions prior to 2.1.5
UnoPim TinyMCEController image upload endpoint
Deployments exposing the UnoPim admin console to network-reachable users

Discovery Timeline

2026-09-02 - CVE-2026-82524 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82524

Vulnerability Analysis

UnoPim ships with a TinyMCE-based rich-text editor that exposes an image upload endpoint at the admin controller TinyMCEController. The endpoint accepts multipart file uploads and stores the content on the public storage disk. Because the controller does not validate the real file extension or MIME type, an authenticated administrator can upload a .php file containing arbitrary code. The server response returns a public URL for the stored file. Requesting that URL causes the PHP interpreter to execute the uploaded payload, granting the attacker command execution with the privileges of the web server user.

Root Cause

The root cause is missing input validation on file uploads in the TinyMCE controller. The pre-patch handler stored files without checking that the extension matches an image allowlist and without verifying that the file's real MIME type corresponds to the claimed extension. This allows content-type spoofing and arbitrary extensions such as .php, .phtml, or .svg to reach a web-executable directory.

Attack Vector

The attack requires authenticated administrator access to the UnoPim admin panel. An attacker with valid credentials, or one who has compromised an administrator account through phishing or credential reuse, submits a crafted multipart request to the TinyMCE upload endpoint. The malicious PHP file is placed on the public storage disk. The attacker then issues an HTTP GET to the returned URL to trigger execution of arbitrary OS commands.

php

// Security patch introduced in v2.1.5 (TinyMCEController.php)
use Illuminate\Http\JsonResponse;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
use Webkul\Admin\Http\Requests\TinyMCEUploadRequest;
use Webkul\Core\Filesystem\FileStorer;

class TinyMCEController extends Controller

php

// New request class enforcing an image allowlist and MIME/extension match
namespace Webkul\Admin\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Webkul\Core\Rules\FileMimeExtensionMatch;

class TinyMCEUploadRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    // SVG and HTML are excluded; FileMimeExtensionMatch rejects
    // files whose real MIME does not match the claimed extension.
    public function rules(): array
    {
        return [
            'file' => [
                // image allowlist and MIME/extension match rule
            ],
        ];
    }
}

Source: UnoPim security commit 675dfb5

Detection Methods for CVE-2026-82524

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar written under the UnoPim public storage disk path.
HTTP POST requests to the TinyMCE upload endpoint containing multipart payloads with non-image Content-Type or extension values.
Subsequent HTTP GET requests to storage URLs immediately after an upload, followed by outbound connections from the PHP-FPM or web server process.
Web server or PHP process spawning shell utilities such as sh, bash, curl, wget, or python.

Detection Strategies

Inspect application access logs for uploads to the TinyMCE controller route where the stored filename does not end in a common raster image extension.
Alert on files created in the UnoPim public storage directory whose extension is on a deny list of interpretable types.
Correlate administrator authentication events with immediate upload activity to identify compromised admin sessions.

Monitoring Recommendations

Enable file integrity monitoring on the UnoPim public storage disk and log any write of non-image content.
Forward web server, PHP-FPM, and audit logs to a centralized analytics platform for behavioral correlation.
Monitor outbound network connections initiated by the web server user, which typically should not originate reverse shells or download tools.

How to Mitigate CVE-2026-82524

Immediate Actions Required

Upgrade UnoPim to version 2.1.5 or later, which introduces the TinyMCEUploadRequest validation class and MIME/extension matching rule.
Rotate credentials for all UnoPim administrator accounts and review admin access logs for suspicious upload activity.
Audit the public storage disk for unexpected files, particularly those with server-executable extensions, and remove any confirmed web shells.

Patch Information

The fix is delivered in UnoPim release v2.1.5. The security commit 675dfb5 adds a dedicated TinyMCEUploadRequest form request that enforces an image extension allowlist, excludes SVG and HTML, and applies the FileMimeExtensionMatch rule to block content-type spoofing. Stored files are also renamed using randomized identifiers. Additional context is available in the VulnCheck advisory and the technical write-up by Ashutosh Jena.

Workarounds

Restrict access to the UnoPim admin console using network controls such as VPN or IP allowlisting until patching is complete.
Configure the web server to disable PHP execution within the public storage directory using per-directory handler rules.
Enforce strong authentication and multi-factor authentication for all administrator accounts to reduce the risk of session compromise.

bash

# Nginx: disable PHP execution inside UnoPim public storage
location ^~ /storage/ {
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}

# Apache equivalent (.htaccess inside the storage directory)
# <FilesMatch "\.(php|phtml|phar)$">
#   Require all denied
# </FilesMatch>