CVE-2026-95830: Pixtream Unrestricted Upload RCE Vulnerability

CVE-2026-95830 Overview

CVE-2026-95830 is an unrestricted file upload vulnerability in theRealSain Pixtream, affecting versions up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0. The flaw resides in the /post_upload.php endpoint, where manipulation of the media argument allows an authenticated remote attacker to upload arbitrary files. The vulnerability maps to [CWE-284: Improper Access Control]. A public exploit has been released, though the vendor did not respond to disclosure attempts. Because Pixtream does not use versioning, no fixed release is available.

Critical Impact
Remote attackers with low-level privileges can upload arbitrary files through the media parameter of /post_upload.php, potentially enabling web shell deployment and follow-on compromise.

Affected Products

theRealSain Pixtream (all revisions up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0)
The /post_upload.php component of Pixtream
No versioned releases available; project distributed via source repository

Discovery Timeline

2026-09-23 - CVE-2026-95830 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95830

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in Pixtream's /post_upload.php handler. When processing multipart form submissions, the endpoint accepts the media argument without adequately validating the file type, extension, or MIME content. This allows an attacker holding a low-privilege account to submit executable server-side scripts disguised as media uploads. Successful upload places attacker-controlled files inside the web root, from which they can be requested and executed by the application server.

The issue is categorized under [CWE-284: Improper Access Control], reflecting the absence of controls that would restrict which file types authenticated users can post. Because Pixtream is distributed without formal version tags, downstream deployments cannot rely on a version comparison to determine exposure. Any deployment built from the affected commit or earlier should be treated as vulnerable.

Root Cause

The root cause is missing validation in the upload handler. The media parameter is accepted and written to a persistent location without enforcing an allowlist of safe extensions, blocking server-executable formats such as .php, or verifying MIME type against file magic bytes. Combined with a web-accessible upload directory, this turns a media upload feature into an arbitrary code execution primitive.

Attack Vector

Exploitation is performed over the network against the Pixtream web interface. The attacker authenticates with any low-privilege account, then submits a crafted POST request to /post_upload.php with a malicious file supplied through the media field. Once written to disk, the attacker requests the uploaded file via HTTP to trigger execution in the context of the web server process. Public exploit code has been released, lowering the barrier to opportunistic abuse.

Exploitation is described in prose only. See the referenced advisory for technical proof-of-concept details:
- GitHub Issue #11 Discussion: https://github.com/yingxiujie/cve/issues/11
- VulDB CVE-2026-95830 Details: https://vuldb.com/cve/CVE-2026-95830

Detection Methods for CVE-2026-95830

Indicators of Compromise

Unexpected files with server-executable extensions (for example .php, .phtml, .phar) in Pixtream upload directories.
HTTP POST requests to /post_upload.php originating from low-privilege accounts followed by GET requests to newly created files.
Web server processes spawning shells, curl, wget, or reverse-shell utilities shortly after an upload event.

Detection Strategies

Inspect web server access logs for POST /post_upload.php requests with atypical Content-Type headers or filenames whose extensions do not match declared MIME types.
Alert on writes to any web-accessible directory that produce files with server-executable extensions.
Correlate authentication events, upload requests, and subsequent process creation on the web server host to surface exploitation chains.

Monitoring Recommendations

Enable file integrity monitoring on Pixtream upload and web root directories.
Forward web server, application, and host process telemetry to a central analytics platform for correlation.
Track outbound network connections from the web server user to detect post-upload command-and-control traffic.

How to Mitigate CVE-2026-95830

Immediate Actions Required

Restrict network access to Pixtream so that only trusted users can reach /post_upload.php.
Disable or gate the upload feature until validation controls can be added to the codebase.
Audit existing upload directories for unauthorized files and remove any server-executable content.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts, and Pixtream does not use versioning, so no fixed release has been published. Operators must apply source-level fixes: enforce an allowlist of media MIME types and extensions in /post_upload.php, rename stored files to non-executable extensions, and store uploads outside the web root. Track updates through the GitHub Issue #11 Discussion and VulDB CVE-2026-95830 Details.

Workarounds

Configure the web server to refuse execution of scripts in upload directories (for example via Apache php_admin_flag engine off or an equivalent NGINX location block).
Place a reverse proxy or web application firewall in front of Pixtream to block uploads whose filenames or content match executable server-side script signatures.
Enforce least-privilege file system permissions so the web server user cannot write to executable code paths outside a dedicated uploads directory.

bash

# Example NGINX hardening: disable script execution in the uploads directory
location ^~ /uploads/ {
    default_type application/octet-stream;
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}