PT-2026-1045 · Unknown+1 · Webuploader+1

St1Tch · Published 2026-01-02 · Updated 2026-01-07 · CVE-2025-15426

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jackying H-ui.admin versions up to 3.1

Description A flaw exists in jackying H-ui.admin that allows for unrestricted file uploads. This issue affects an unknown function within the /lib/webuploader/0.1.5/server/preview.php library. The attack can be carried out remotely. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 3.1 should be updated. As a temporary workaround, consider restricting access to the /lib/webuploader/0.1.5/server/preview.php file to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2025-15426

Affected Products

H-Ui.Admin

Webuploader

References · 12

• 🔥 https://github.com/TiKi-r/CVE-Report/blob/main/H-ui.admin%20RCE.md#4-proof-of-concept-poc · Exploit
• 🔥 https://github.com/TiKi-r/CVE-Report/blob/main/H-ui.admin%20RCE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15426 · Security Note
• https://vuldb.com/?ctiid.339348 · Note
• https://vuldb.com/?submit.721457 · Note
• https://twitter.com/CVEnew/status/2006952105743929450 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006952748223279516 · Twitter Post
• https://vuldb.com/?id.339348 · Note
• https://t.me/CVEtracker/41213 · Telegram Post
• https://twitter.com/cracbot/status/2008856182631567696 · Twitter Post
• https://t.me/cveNotify/147475 · Telegram Post
• https://twitter.com/cracbot/status/2008493814487675235 · Twitter Post