High severity · published Sep 2, 2026
CVE-2026-82524
UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
unopim · unopim
before 2.1.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82524
release-notes
https://github.com/unopim/unopim/releases/tag/v2.1.5
patch
https://github.com/unopim/unopim/commit/675dfb5155a87f94c5ac861545a31b8f6ea44f5b
technical-description
https://ashutosh-jena.in/blog/remote-code-execution-rce-via-unrestricted-file-upload-in-unopim-v214
third-party-advisory
https://www.vulncheck.com/advisories/unopim-file-upload-rce-via-tinymce-image-upload-endpoint
More from unopim
8.8
CVE-2025-55745
UnoPim Quick Export feature is vulnerable to CSV injection
8.8
CVE-2025-55743
UnoPim vulnerable to remote code execution through Arbitrary File upload
8.1
CVE-2025-55741
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
7.1
CVE-2026-85395
UnoPim before 2.1.3 Missing Authorization on Integration Management Routes
4.8
CVE-2025-55742
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass