Description

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T19:16:55.503Z",
  "pubdate": "2026-08-25T19:16:55.503Z",
  "executiveSummary": "ContiNew Admin is susceptible to an arbitrary file upload vulnerability within its multipart upload endpoints. The flaw arises from an absence of file-type allowlist validation and inadequate permission checks during the upload process. An authenticated attacker can leverage these deficiencies to upload arbitrary files, including those with malicious extensions, directly to the storage backend.\nOnce uploaded, these files become accessible via web server URLs, potentially allowing for remote code execution (RCE) if the server is configured to execute uploaded scripts or if the files are used to facilitate secondary attacks such as cross-site scripting (XSS).\nThe vulnerability requires an authenticated session, but it provides a significant escalation path for attackers with access to low-privileged accounts. The risk is high, as the ability to introduce arbitrary files into the web application directory structure bypasses standard security controls, undermining the integrity of the host server and potentially compromising the entire application environment.",
  "technicalDetails": "The vulnerability resides in the multipart upload functionality of ContiNew Admin, which lacks server-side enforcement of file-type allowlists and proper access control authorization. The application fails to validate the 'Content-Type' header or inspect the file extension against a secure set of permitted MIME types or extensions before committing the file to the persistent storage layer.\nThe attack flow initiates when an authenticated user leverages the multipart upload API. By crafting a multipart/form-data request, an attacker can transmit malicious payloads in chunks. The application processes these chunks without validating the final file's integrity or extension, effectively treating all uploaded segments as legitimate data. Once the full file is reconstituted and the upload is marked as complete, the storage backend stores the file in a directory accessible to the web server.\nBecause the server lacks explicit security configuration to prevent the execution of scripts in the storage directory, an attacker can upload web shells (e.g., .php, .jsp, or .aspx files, depending on the underlying technology stack). Once stored, the attacker can navigate to the known URL of the uploaded file, triggering the web server to execute the malicious code. This results in full compromise of the application server, allowing for unauthorized data access, system command execution, and lateral movement within the network.\nThe root cause is a failure in the application's input validation layer. Specifically, the upload handler fails to perform recursive extension checking or content inspection (magic byte analysis). Additionally, the absence of file renaming or storage outside of the document root exacerbates the impact, as uploaded files are directly mappable to web-accessible resources. The exploitation does not require administrative privileges, as any account capable of initiating a file upload can exploit the lack of server-side restrictions. The persistence of these files in the storage backend allows for a delayed execution window, facilitating stealthy backdooring of the application instance."
}