CVE-2026-82524

High

Description

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.

SeverityHigh

CVSS7.2

Exploit probability—

ProductUnopim

PublishedSep 2, 2026

First seenSep 2, 2026

Weakness typeCWE-434Unrestricted upload of dangerous file type

How to fix

Update

unopim unopim2.1.5 or later

Patches

github.com/unopim/unopim/commit/675dfb5155a87f94c5ac861545a31b8f6ea44f5b

Vendor advisories

github.com/unopim/unopim/releases/tag/v2.1.5

Affected products

Product	Affected versions	Fixed in
unopim unopim	v < 2.1.5	2.1.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.