UnoPim versions prior to 2.1.5 allow authenticated administrators to execute arbitrary code via an insecure TinyMCE image upload endpoint that fails to validate file extensions.
UnoPim +1
web-application
rce
file-upload
cve-2026-82524
1r
3t
1c
updated