PT-2026-6920 · Unknown+1 · Webuploader+1

St1Tch · CVE-2026-2113 · Published 2026-02-07 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yuan1994 tpadmin versions up to 1.3.12

Description A security issue exists in yuan1994 tpadmin up to version 1.3.12. The issue is related to deserialization within the WebUploader component, specifically in the file /public/static/admin/lib/webuploader/0.1.5/server/preview.php. This can be exploited remotely. The exploit for this issue has been publicly disclosed. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations Versions prior to 1.3.12 should not be used.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Unrestricted File Upload

Weakness Enumeration

CWE-20

CWE-502

CWE-434

Related Identifiers

CVE-2026-2113

Affected Products

Webuploader

Ftp Admin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2113.json · Exploit
• 🔥 https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2113 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2113 · Vendor Advisory
• https://t.me/CVEtracker/44051 · Telegram Post
• https://vuldb.com/?submit.746795 · Note
• https://t.me/cveNotify/151264 · Telegram Post
• https://twitter.com/CVEnew/status/2020246663516889414 · Twitter Post
• https://t.me/cveNotify/154396 · Telegram Post
• https://vuldb.com/?ctiid.344688 · Note
• https://vuldb.com/?id.344688 · Note