CVE-2026-7733: funadmin Unrestricted File Upload Exposes Systems
A critical vulnerability, CVE-2026-7733, has been identified in funadmin up to version 7.1.0-rc6. This flaw resides within the UploadService::chunkUpload function, specifically in the frontend chunked upload endpoint. According to the National Vulnerability Database, this vulnerability permits unrestricted file upload due to improper handling of the File argument.
The impact is significant: attackers can remotely exploit this weakness without authentication, achieving arbitrary file upload. The National Vulnerability Database has assigned a CVSS v3.1 score of 7.3 (HIGH), underscoring the severity. The exploit for this vulnerability is public, meaning attackers can readily leverage it in the wild.
For defenders, this is a clear and present danger. Unrestricted file upload vulnerabilities are a favored vector for initial access, often leading to remote code execution (RCE) by uploading web shells or malicious scripts. Organizations using affected funadmin versions must prioritize patching to mitigate the risk of compromise.
What This Means For You
- If your organization uses funadmin, you must immediately verify your version. Prioritize deploying the patch for CVE-2026-7733 to prevent remote, unauthenticated attackers from uploading malicious files to your servers. Audit your logs for any suspicious file uploads or unexpected new files in web-accessible directories.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7733: funadmin Unrestricted File Upload via Chunk Upload
title: CVE-2026-7733: funadmin Unrestricted File Upload via Chunk Upload
id: scw-2026-05-04-ai-1
status: experimental
level: high
description: |
Detects the specific endpoint and action used in CVE-2026-7733 for unrestricted file uploads. The vulnerability lies in the UploadService::chunkUpload function, allowing remote attackers to upload arbitrary files by manipulating the 'File' argument.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7733/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/app/common/service/UploadService.php'
cs-method|exact:
- 'POST'
sc-status|exact:
- '200'
selection_indicators:
cs-uri-query|contains:
- 'action=chunkUpload'
condition: selection AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7733 | Unrestricted Upload | funadmin up to 7.1.0-rc6 |
| CVE-2026-7733 | Unrestricted Upload | funadmin app/common/service/UploadService.php |
| CVE-2026-7733 | Unrestricted Upload | funadmin UploadService::chunkUpload function |
| CVE-2026-7733 | Unrestricted Upload | funadmin Frontend Chunked Upload Endpoint |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 04, 2026 at 09:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7738 — Puchunjie Doc-Tools-Mcp Path Traversal
CVE-2026-7738 — A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP...
CVE-2026-7737 — Osrg GoBGP Out-of-Bounds $1
CVE-2026-7737 — A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of...
CVE-2026-7736: GoBGP Integer Underflow Threatens BGP Routing
CVE-2026-7736 — A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing...