{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/arbitrary-file-upload/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-7490"}],"_cs_exploited":false,"_cs_products":["CTMS","CPAS"],"_cs_severities":["high"],"_cs_tags":["arbitrary-file-upload","web-shell","code-execution"],"_cs_type":"advisory","_cs_vendors":["Sunnet"],"content_html":"\u003cp\u003eCVE-2026-7490 is an arbitrary file upload vulnerability found in Sunnet CTMS and CPAS. Disclosed in May 2026, this vulnerability enables a privileged attacker to upload malicious files, specifically web shell backdoors, to the affected server. This can be achieved remotely, without requiring local system access, given the attacker already possesses valid privileged credentials for the application. Successful exploitation allows the attacker to execute arbitrary code on the server, potentially leading to complete system compromise. This vulnerability poses a significant threat to organizations using these Sunnet products, as it could result in data breaches, service disruption, and other malicious activities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains privileged access to the CTMS or CPAS application, either through credential theft, phishing, or other means.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the file upload functionality within the application.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious file, such as a PHP web shell, designed to execute arbitrary commands on the server.\u003c/li\u003e\n\u003cli\u003eAttacker bypasses any client-side file type validation mechanisms.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the malicious file to the server through the vulnerable file upload endpoint.\u003c/li\u003e\n\u003cli\u003eThe application saves the file to a publicly accessible directory without proper sanitization or validation.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the uploaded web shell via a web browser.\u003c/li\u003e\n\u003cli\u003eAttacker uses the web shell to execute arbitrary commands on the server, leading to full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-7490 allows attackers to execute arbitrary code on the affected server. This can lead to a range of malicious activities, including data theft, modification, or destruction, installation of malware, and complete system takeover. Since the vulnerability affects CTMS and CPAS, organizations in sectors utilizing these systems for content or process management are particularly at risk. The vulnerability\u0026rsquo;s high severity allows attackers to quickly gain a foothold and potentially compromise sensitive information or disrupt business operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply available patches or updates from Sunnet to address CVE-2026-7490.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect Malicious File Uploads to Web Servers\u003c/code\u003e to detect suspicious file uploads based on file extensions and content.\u003c/li\u003e\n\u003cli\u003eReview and harden file upload functionalities within CTMS and CPAS to prevent arbitrary file uploads.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for access to suspicious files in upload directories, using the \u003ccode\u003eWeb Shell Access\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003cli\u003eRestrict access to file upload functionalities to only authorized users with appropriate privileges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-02T10:16:18Z","date_published":"2026-05-02T10:16:18Z","id":"/briefs/2026-05-sunnet-file-upload/","summary":"A privileged remote attacker can exploit CVE-2026-7490 in Sunnet CTMS and CPAS to upload and execute web shell backdoors, leading to arbitrary code execution on the server.","title":"Sunnet CTMS/CPAS Arbitrary File Upload Vulnerability (CVE-2026-7490)","url":"https://feed.craftedsignal.io/briefs/2026-05-sunnet-file-upload/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["mckenziearts/livewire-markdown-editor (\u003c 1.3)","DigitalOcean Spaces","Cloudflare R2","Scaleway Object Storage"],"_cs_severities":["high"],"_cs_tags":["arbitrary-file-upload","stored-xss","vulnerability"],"_cs_type":"advisory","_cs_vendors":["DigitalOcean","Cloudflare","Scaleway"],"content_html":"\u003cp\u003eVersions of \u003ccode\u003emckenziearts/livewire-markdown-editor\u003c/code\u003e prior to v1.3 are vulnerable to arbitrary file upload via the \u003ccode\u003eMarkdownEditor::updatedAttachments()\u003c/code\u003e Livewire handler. This handler lacks server-side validation for file types, extensions, and content. An authenticated user with access to a page embedding the markdown editor can upload malicious files (e.g., \u003ccode\u003e.html\u003c/code\u003e, \u003ccode\u003e.svg\u003c/code\u003e, \u003ccode\u003e.js\u003c/code\u003e) to the disk configured by \u003ccode\u003elivewire-markdown-editor.disk\u003c/code\u003e. If this disk is a public cloud storage bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage), the uploaded files are publicly accessible with a guessed \u003ccode\u003eContent-Type\u003c/code\u003e header. This vulnerability allows attackers to perform stored XSS, host phishing pages, distribute malware, and inject malicious markdown. A real-world exploitation was observed in production.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to an application using a vulnerable version of \u003ccode\u003emckenziearts/livewire-markdown-editor\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to a page embedding the \u003ccode\u003e\u0026lt;livewire:markdown-editor\u0026gt;\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the file upload functionality of the editor to upload a malicious file, such as a \u003ccode\u003e.html\u003c/code\u003e or \u003ccode\u003e.svg\u003c/code\u003e file containing XSS payloads.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMarkdownEditor::updatedAttachments()\u003c/code\u003e Livewire handler processes the uploaded file without proper validation.\u003c/li\u003e\n\u003cli\u003eThe handler stores the file on the disk configured by \u003ccode\u003elivewire-markdown-editor.disk\u003c/code\u003e (e.g., a public cloud bucket like S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage).\u003c/li\u003e\n\u003cli\u003eThe uploaded file becomes publicly accessible on the storage domain.\u003c/li\u003e\n\u003cli\u003eA user visits the URL of the uploaded malicious file, triggering the XSS payload or accessing the phishing page.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their objective, such as stealing user credentials, redirecting users to malicious websites, or compromising the application\u0026rsquo;s integrity.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability can lead to several critical impacts. Stored XSS on the storage domain can allow attackers to steal user credentials or perform other malicious actions in the context of the application. Phishing pages hosted on the application\u0026rsquo;s storage domain can trick users into revealing sensitive information. Malware distribution from a domain users trust can lead to widespread infections. Additionally, markdown injection via crafted filenames can compromise the integrity of the editor\u0026rsquo;s output. A real-world exploitation of this vulnerability was observed in production on a community platform using this package.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003emckenziearts/livewire-markdown-editor\u003c/code\u003e v1.3 or later to patch the vulnerability.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrading is not feasible, disable the upload UI on every instance of the editor by passing \u003ccode\u003e:show-upload=\u0026quot;false\u0026quot;\u003c/code\u003e. This prevents the vulnerable code path from being reached.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs (category \u003ccode\u003ewebserver\u003c/code\u003e, product \u003ccode\u003elinux\u003c/code\u003e) for requests to the storage domain for unusual file extensions like \u003ccode\u003e.html\u003c/code\u003e, \u003ccode\u003e.svg\u003c/code\u003e, \u003ccode\u003e.js\u003c/code\u003e, \u003ccode\u003e.php\u003c/code\u003e, or \u003ccode\u003e.exe\u003c/code\u003e, which could indicate attempted exploitation.\u003c/li\u003e\n\u003cli\u003eImplement the file upload detection rule to identify potentially malicious file uploads to the storage domain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"/briefs/2024-01-02-livewire-markdown-editor-upload/","summary":"The livewire-markdown-editor versions before v1.3 contain an arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments() Livewire handler, allowing authenticated users to upload any file type, potentially leading to stored XSS, phishing, malware distribution, and markdown injection.","title":"livewire-markdown-editor Arbitrary File Upload Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-02-livewire-markdown-editor-upload/"}],"language":"en","title":"CraftedSignal Threat Feed — Arbitrary-File-Upload","version":"https://jsonfeed.org/version/1.1"}