Unrestricted File Upload Vulnerability in ShopEx ECShop

A vulnerability identified as CVE-2026-82921 affects ShopEx ECShop versions up to 2.5.1. The flaw exists within the check_img_type function located in the admin/pack.php script. An unauthenticated remote attacker can exploit this weakness by manipulating the pack_img parameter to bypass file type validation, allowing for the upload of arbitrary, potentially malicious files to the server. Successful exploitation of this vulnerability can lead to remote code execution (RCE) if the uploaded file is subsequently executed by the web server. Public exploit code for this vulnerability is available, and there is no indication that the vendor has addressed this issue following initial disclosure. Defenders should prioritize restricting access to the administrative directory and monitoring for suspicious file uploads.

Attack Chain

1. Attacker identifies a target server running an unpatched version of ShopEx ECShop (<= 2.5.1).
2. Attacker performs reconnaissance to locate the admin/pack.php script.
3. Attacker crafts a malicious payload (e.g., a PHP web shell) embedded within an image file structure.
4. Attacker sends a crafted HTTP POST request to the admin/pack.php endpoint.
5. Attacker manipulates the pack_img argument within the request to bypass server-side file type checks in check_img_type.
6. The server saves the malicious file to the web root or an accessible upload directory.
7. Attacker navigates to the uploaded file's URL to trigger code execution on the server.
8. Attacker establishes persistent access or begins data exfiltration.

Impact

Successful exploitation allows for arbitrary file uploads, which provides a direct path for remote code execution. This can result in complete system compromise, unauthorized data access, and lateral movement within the network. Sectors relying on ECShop for e-commerce operations are at high risk of site defacement, financial data theft, and loss of customer information.

Recommendation

Prioritized actions for detection engineering and security teams:

• Implement strict ingress filtering for the /admin/ directory to ensure it is not reachable from the public internet.
• Deploy the provided Sigma rule to detect suspicious HTTP requests targeting the admin/pack.php script.
• Monitor web server access logs for anomalous POST requests to admin/pack.php that contain unexpected file extensions or script contents.
• Configure file integrity monitoring on the web server's document root to alert on the creation of new executable files in upload directories.