CVE-2026-80050

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-800515.9github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The b CVE-2026-800545.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Incorrect Permiss CVE-2026-800554.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali CVE-2026-800565.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sens CVE-2026-800575.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded CVE-2026-800585.5Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage CVE-2026-80065.4Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a ma CVE-2026-80077.5Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the CVE-2026-800717.2The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate th CVE-2026-800724.7The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirect CVE-2026-800736.5Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.CVE-2026-800748.8Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.