Executive brief
ContiNew Admin is a multi-tenant backend management framework used to build administrative systems and dashboards. Attackers with valid user accounts can upload files with arbitrary extensions and dangerous content through the multipart upload feature, because permission checks and file-type validation are not enforced. These uploaded files become accessible through the web server, potentially allowing code execution or other attacks.
Technical details
The vulnerability is an authentication bypass combined with file-upload validation failure in the multipart upload endpoints (MultipartUploadController). The system fails to apply file-type allowlist validation and permission checks when processing chunked file uploads (/init, /upload, /complete endpoints). Authenticated users can initialize chunked uploads, send arbitrary file parts, and complete uploads to store files with dangerous extensions in the web-accessible storage backend. An attacker with valid credentials can achieve arbitrary file write and potentially remote code execution if the storage location is executable.
Affected products
- ContiNew Admin v4.1.0 and likely others
Timeline
- 2026-08-25: disclosed