CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
Authenticated administrators can upload arbitrary PHP files via TinyMCE, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82524?
CVE-2026-82524 is a high-severity vulnerability in unopim, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
Weakness: CWE-434
Which versions are affected by CVE-2026-82524?
How do I fix CVE-2026-82524?
No fix has been published for CVE-2026-82524 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82524 exists.
Sources
Also known as GHSA-q5p4-3w6j-xg73.