CVE-2026-82524

UnoPim before 2.1.5 fails to validate file extensions and MIME types on the TinyMCE image upload endpoint, allowing an authenticated administrator to upload arbitrary PHP files. An attacker with administrator credentials uploads a PHP web shell to the public storage disk and then requests the URL returned in the upload response, causing the server to execute the file. Successful exploitation yields arbitrary operating-system command execution and full compromise of the underlying server. Only UnoPim deployments running versions prior to 2.1.5 are affected, and exploitation requires valid administrator access, so exposed instances with compromised or reused admin credentials are at greatest risk. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS (0.3%) suggests exploitation is currently unlikely.

What to do: Upgrade UnoPim to version 2.1.5 or later. As interim mitigation, restrict and protect administrator accounts (strong credentials, MFA), block PHP execution in the public storage directory, and audit that directory for unexpected .php files that may already have been uploaded as web shells.