CVE-2026-2113

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502 CWE-434

Affected software

Vendor	Product	Versions
yuan1994	tpadmin	1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 1.3.10; 1.3.11; 1.3.12

References

https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.344688Permissions Required, VDB Entry
https://vuldb.com/?id.344688Third Party Advisory, VDB Entry
https://vuldb.com/?submit.746795Third Party Advisory, VDB Entry

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-211305.1Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an ar CVE-2026-211312.1Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung F CVE-2026-211326.0Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interactio CVE-2026-211335.1Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.CVE-2026-211346.1Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.CVE-2026-211355.9Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.CVE-2026-211366.8Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.CVE-2026-211375.1Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.CVE-2026-211386.9Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applic CVE-2026-211397.3Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co CVE-2026-21149.8A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_CVE-2026-211406.9Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.