PT-2026-1045 · Unknown+1 · Webuploader+1

St1Tch · Publicado 2026-01-02 · Atualizado 2026-01-07 · CVE-2025-15426

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jackying H-ui.admin versions up to 3.1

Description A flaw exists in jackying H-ui.admin that allows for unrestricted file uploads. This issue affects an unknown function within the /lib/webuploader/0.1.5/server/preview.php library. The attack can be carried out remotely. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 3.1 should be updated. As a temporary workaround, consider restricting access to the /lib/webuploader/0.1.5/server/preview.php file to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Improper Access Control

Enumeração de Fraquezas

CWE-434

CWE-284

Identificadores relacionados

CVE-2025-15426

Produtos afetados

H-Ui.Admin

Webuploader

Referências · 12

• 🔥 https://github.com/TiKi-r/CVE-Report/blob/main/H-ui.admin%20RCE.md#4-proof-of-concept-poc · Exploit
• 🔥 https://github.com/TiKi-r/CVE-Report/blob/main/H-ui.admin%20RCE.md · Exploit
• https://vuldb.com/?ctiid.339348 · Nota
• https://vuldb.com/?submit.721457 · Nota
• https://twitter.com/CVEnew/status/2006952105743929450 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15426 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2006952748223279516 · Publicação no Twitter
• https://vuldb.com/?id.339348 · Nota
• https://t.me/CVEtracker/41213 · Publicação no Telegram
• https://twitter.com/cracbot/status/2008856182631567696 · Publicação no Twitter
• https://t.me/cveNotify/147475 · Publicação no Telegram
• https://twitter.com/cracbot/status/2008493814487675235 · Publicação no Twitter