CVE-2026-82921— ShopEx ECShop pack.php check_img_type unrestricted upload
Quick assessment
Affected
ShopEx ECShop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ShopEx ECShop 2.5.1 及更早版本中发现了一个安全弱点。该问题影响了文件 中的 函数。通过对参数 进行恶意操作，可能导致无限制的上传漏洞。该漏洞可被远程利用。相关的利用代码/利用方式已公开，可被用于发起攻击。安全研究人员已提前联系了软件供应商，但供应商未作任何回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82921
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ShopEx ECShop pack.php check_img_type unrestricted upload
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82921
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82921
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82921 (1)
-
🔗 CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload Read full article vdb-entry technical-description
Other References for CVE-2026-82921 (3)
-
-
🔗 CVE-2026-82921 in ECShop third-party-advisory
-
🔗 Submit #879229: Shopex ECShop v2.5.1 Unrestricted Upload third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-434
-
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter all -
CVE-2026-81780
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload -
CVE-2026-82970
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent -
CVE-2026-78078
Joomla Extension - joomshaper.com - Privileged File Upload B -
CVE-2026-82679
diem-project diem Widget Editor dmWidgetContentBaseMediaForm
V. Comments for CVE-2026-82921
No comments yet