PT-2026-28717 · Unknown · Z-9527 Admin

Vuldb · CVE-2026-4999 · Published 2026-03-28 · Updated 2026-03-29

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions z-9527 admin versions prior to 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2

Description A security issue has been identified in z-9527 admin. The issue resides within the uploadFile function located in the /server/utils/upload.js file, specifically within the isImg Check component. Manipulation of the fileType argument can lead to a path traversal condition. Remote exploitation is possible. The exploit has been publicly disclosed.

Recommendations Update z-9527 admin to version 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2 or later. As a temporary workaround, restrict access to the uploadFile function in the /server/utils/upload.js file. Avoid using the fileType parameter in the uploadFile function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4999

Affected Products

Z-9527 Admin

References · 8

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4999 · Security Note
• https://twitter.com/cyberbivash/status/2037966244431659460 · Twitter Post
• https://twitter.com/CVEnew/status/2038135173641064541 · Twitter Post
• https://vuldb.com/vuln/353886 · Note
• https://twitter.com/CVEarity/status/2038196762775830835 · Twitter Post
• https://vuldb.com/submit/778277 · Note
• https://vuldb.com/vuln/353886/cti · Note