Authenticated Arbitrary File Upload in UnoPim

UnoPim versions before 2.1.5 are vulnerable to an authenticated arbitrary file upload flaw (CVE-2026-82524). The vulnerability resides in the TinyMCE image upload endpoint, which lacks sufficient validation of file extensions and MIME types. An attacker with administrative privileges can upload a PHP web shell to the application's public storage directory. Once uploaded, the attacker can trigger the malicious script by navigating to the file path returned in the server's HTTP response, resulting in remote code execution (RCE) on the underlying server. This vulnerability is significant because it allows a compromised administrative account to achieve full system control, bypassing intended restrictions on the file upload functionality.

Attack Chain

1. The attacker authenticates to the UnoPim administrative dashboard using valid or compromised credentials.
2. The attacker navigates to the TinyMCE image upload feature within the application interface.
3. The attacker crafts a request to the TinyMCE image upload endpoint containing a malicious PHP file payload.
4. The UnoPim server receives the file and fails to perform server-side validation of the 'extension' or 'MIME type' attributes.
5. The server stores the malicious PHP file within a public-facing directory on the web server storage disk.
6. The application returns the URL path of the uploaded file to the attacker in an HTTP response.
7. The attacker sends an HTTP GET request to the path of the uploaded PHP file.
8. The web server executes the PHP code, enabling command execution or persistent backdoor access.

Impact

Successful exploitation allows for full remote code execution on the server hosting the UnoPim instance. As the vulnerability requires administrative access, it is typically used for lateral movement or persistence after an initial account compromise. The impact includes potential full system compromise, data exfiltration from the database or storage, and the ability to pivot to other internal network resources.

Recommendation

1. Upgrade UnoPim to version 2.1.5 or later immediately to incorporate necessary file validation logic.
2. Monitor web server logs for HTTP POST requests to the TinyMCE image upload endpoint that contain unusual file extensions (e.g., .php, .phtml, .php7).
3. Restrict administrative access to the UnoPim dashboard to known-trusted management IP addresses.
4. Audit the public storage directory for unauthorized script files that do not match expected image file formats.