Arbitrary file upload in Unopim
CVE-2026-82524
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (49.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.003
Affected products
Weakness classification (CWE)
References
- ashutosh-jena.in/blog/remote-code-execution-rce-via-unrestricted-file-upload-in… (technical-description, exploit)
- github.com/unopim/unopim/commit/675dfb5155a87f94c5ac861545a31b8f6ea44f5b (patch)
- github.com/unopim/unopim/releases/tag/v2.1.5 (release-notes)
- www.vulncheck.com/advisories/unopim-file-upload-rce-via-tinymce-image-upload-en… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82524?
- CVE-2026-82524 is a high-severity vulnerability in Unopim, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-09-02.
- How severe is CVE-2026-82524?
- High severity. CVSS v3 base score is 7.2 out of 10.