UnOpim v2.1.4 TinyMCE file upload RCE vulnerability analysis and fix

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: In UnOpim v2.1.4, the TinyMCE editor file upload feature lacks strict validation, resulting in an Unrestricted File Upload, which leads to Remote Code Execution (RCE). Severity: Critical (CVSS 3.1 Score 9.1) Affected Component: Affected Versions: UnOpim v2.1.4 and earlier versions Fixed Version: Fix confirmed in UnOpim v2.1.5 Disclosure Timeline: Disclosed on 2026-06-08, fixed on 2026-06-10 Impact Scope Successful exploitation of this vulnerability allows an authenticated administrator to: Execute arbitrary PHP code on the server (full RCE) Access sensitive files unauthorized (e.g., the file containing database credentials, ) Escalate privileges via group permissions (e.g., , ) Ultimately result in full system compromise Remediation 1. Strict Validation: Implement robust file type whitelist validation on the server side, allowing only expected types (e.g., , , , , , ). 2. Secure Storage: Store uploaded files outside the web root directory, or place them on a non-executable storage volume (e.g., S3). 3. File Renaming: Rename files using a cryptographically secure random UUID after upload to prevent predictable execution paths. POC Exploitation Code Summary of Exploitation Steps: 1. Log in to the UnOpim admin dashboard 2. Navigate to a page containing the TinyMCE editor (e.g., Catalog > Categories > Edit) 3. Click the image upload button in the toolbar to prepare to upload a file 4. Use a proxy (e.g., Burp Suite) to intercept the multipart POST request sent to 5. Change the legitimate image name to and replace the image binary body with the PHP code above 6. Forward the request; the server returns 200 OK and provides the direct path to the uploaded file 7. Access the returned URL with the parameter to execute system commands, for example:

Goal Reached Thanks to every supporter — we hit 100%!

UnOpim v2.1.4 TinyMCE file upload RCE vulnerability analysis and fix