Description

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-02T20:17:39.210Z",
  "pubdate": "2026-09-02T20:17:39.210Z",
  "executiveSummary": "UnoPim versions prior to 2.1.5 are susceptible to an authenticated arbitrary file upload vulnerability located within the TinyMCE image upload endpoint.\nThe vulnerability stems from the absence of robust server-side validation mechanisms for uploaded file extensions and MIME types.\nAn authenticated user with administrative privileges can leverage this flaw to upload malicious PHP files to the server's public storage disk.\nSuccessful exploitation permits the execution of arbitrary operating system commands, resulting in full remote code execution (RCE).\nThe impact is critical, as it compromises the confidentiality, integrity, and availability of the application server.\nExploitation requires valid administrative authentication, after which the attacker can access the uploaded shell directly via its public URL, thereby triggering execution.",
  "technicalDetails": "The vulnerability resides in the TinyMCE image upload handling logic within the UnoPim application. The core issue is an improper input validation vulnerability where the application fails to enforce security constraints on user-supplied files.\nSpecifically, the file upload endpoint does not verify the file extension or the MIME type of the uploaded entity, allowing an attacker to bypass intended restrictions and upload executable scripts rather than intended image formats.\nThe attack flow begins when an authenticated administrator interacts with the TinyMCE image upload component. The attacker crafts a request containing a malicious PHP web shell disguised as an image file. Because the application lacks server-side filtering, it accepts the file and saves it to the public storage disk.\nThe application subsequently returns the URL of the stored file to the user. An attacker can then access this specific URL via standard HTTP requests. Since the server is configured to parse and execute PHP files located in this directory, the web shell is executed by the server's PHP interpreter.\nThis execution context allows the attacker to execute arbitrary OS commands with the permissions of the web server user. This constitutes a Remote Code Execution (RCE) event, granting the attacker full control over the application environment.\nThe vulnerability affects UnoPim versions before 2.1.5. No sanitization occurs at the entry point of the TinyMCE upload endpoint, and the storage of the file in a public-facing directory ensures that the payload is accessible and executable by anyone with network connectivity to the web server.\nPost-exploitation, an attacker can escalate privileges, access sensitive database information, pivot into the internal network, or deploy persistent backdoors to maintain long-term unauthorized access."
}