Executive brief
Pixtream is a web-based media sharing platform. The application improperly validates file uploads in its post_upload.php endpoint, allowing authenticated attackers to bypass content-type checks and upload malicious files including web shells. An attacker exploiting this vulnerability can execute arbitrary code on the server, potentially stealing data or disrupting business operations.
Technical details
The post_upload.php endpoint checks the HTTP Content-Type header against a whitelist of media types (JPEG, PNG, GIF, MP4, AVI, FLV, OGG, WebM) but does not perform server-side file validation. An authenticated attacker can spoof the Content-Type header and upload executable files such as PHP web shells, leading to remote code execution. The vulnerability requires authentication but no user interaction beyond a standard HTTP request.
Affected products
- theRealSain Pixtream up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0
Timeline
- 2026-07-20: disclosed
- 2026-09-23: advisory