Executive brief
Dcat-Admin, an administrative interface builder for PHP applications, contains a security flaw in its user settings page. An attacker with administrative privileges can upload unauthorized files to the server, which could lead to a disruption of service or unauthorized access to data. While the attack requires high-level permissions, the public availability of exploit code increases the risk of misuse.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in Dcat-Admin versions up to 2.2.3-beta. The flaw is located in the editorMDUpload function within the /admin/dcat-api/editor-md/upload endpoint, specifically affecting the User Setting Page component. By manipulating the 'editormd-image-file' argument, a remote attacker with high privileges (PR:H) can bypass access controls to upload arbitrary files. This could potentially lead to remote code execution depending on the server configuration. Public exploit code has been released, though the vulnerability requires authentication to exploit.
Affected products
- Dcat-Admin Dcat-Admin up to 2.2.3-beta
Timeline
- 2026-06-09: disclosed: Vulnerability published via VulDB and NVD