CVE-2026-4337EUVD-2026-110807GHSA-57JC-X74J-F4W4
Unrestricted Upload of File in PuMuKIT application
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
PuMuKIT, a web-based multimedia platform, is affected by this vulnerability, which lets anyone without logging in upload files of any type to any location the web server can write to. An attacker could use this to place malicious files on the server or delete existing files.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- PuMuKIT PuMuKIT
current version