CVE-2026-2113

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2113

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2113.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2113

Published

2026-02-07T21:15:45.697Z

Modified

2026-04-02T13:07:47.564091Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

References

Affected packages

Git / github.com/yuan1994/tpadmin

Affected ranges

Type

GIT

Repo

https://github.com/yuan1994/tpadmin

Events

Introduced

Last affected

2c651128f29d369b00f111bf814b0b29d21f1c60

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.12"
        }
    ]
}

Affected versions

v1.*

v1.1

v1.2

v1.2.1

v1.2.2

v1.3

v1.3.1

v1.3.10

v1.3.11

v1.3.12

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.3.6

v1.3.7

v1.3.8

v1.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2113.json"