High severity · published May 4, 2026
CVE-2026-7733
funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
funadmin · Funadmin
7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4; 7.1.0-rc5; 7.1.0-rc6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7733
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7733
gitee.com
https://gitee.com/funadmin/funadmin/
gitee.com
https://gitee.com/funadmin/funadmin/issues/IJ8NXT
gitee.com
https://gitee.com/funadmin/funadmin/pulls/59
vuldb.com
https://vuldb.com/submit/807559
vuldb.com
https://vuldb.com/vuln/360908
vuldb.com
https://vuldb.com/vuln/360908/cti
More from funadmin
9.8
CVE-2023-36097
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install
9.8
CVE-2023-24774
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php
9.8
CVE-2023-24773
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list
9.8
CVE-2023-24782
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit
9.8
CVE-2023-24777
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list