Junglewise Threat Intelligence

CVE-2026-15488: hcr707305003 shiroiAdmin unrestricted file upload in FileController

CVE-2026-15488 · Severity: high · CVSS 7.3 · Published 2026-07-12

Executive brief

shiroiAdmin is a back-end management system based on the ThinkPHP framework. A security flaw in the system's file upload component allows remote attackers to upload unauthorized files to the server. In certain environments, this could allow an attacker to execute malicious code, potentially leading to a full system takeover or data theft.

Technical details

An unrestricted file upload vulnerability exists in shiroiAdmin versions 1.1 and 1.3 within the FileController::upload function. The root cause is the application's reliance on a client-controlled 'file_type' parameter to determine upload validation rules, combined with a lack of robust server-side extension filtering. A remote, unauthenticated attacker can manipulate this parameter to bypass intended restrictions and upload dangerous file types (such as PHP scripts). If the uploaded files are stored in a web-accessible directory and the server is configured to execute them, this leads to Remote Code Execution (RCE). The issue is addressed in version 1.4 by removing client-side control of the file type parameter and implementing a server-side whitelist and dangerous extension blacklist.

Affected products

  • hcr707305003 shiroiAdmin 1.1, 1.3

Timeline

  • 2026-05-31: patched: Version 1.4 released with security fixes
  • 2026-07-12: advisory: CVE-2026-15488 published

References