CVE-2026-7733: Funadmin Improper Access Control Vulnerability
Summary
CVE-2026-7733: Funadmin has an Improper Access Control Issue. Affects funadmin/funadmin versions < 7.1.0-rc6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Funadmin is an open-source administration panel designed for managing web applications efficiently. It provides functionalities such as user management, file uploads, and various administrative tasks. However, versions up to 7.1.0-rc6 are susceptible to an improper access control vulnerability that allows unauthorized file uploads, potentially compromising the security of the application.
Vulnerability Detail
The vulnerability arises from a flaw in the UploadService::chunkUpload function located in app/common/service/UploadService.php. This issue allows an attacker to manipulate the File argument, leading to unrestricted file uploads. The attack can be executed remotely, making it a significant risk for applications using affected versions of Funadmin. If exploited, this vulnerability could allow an attacker to upload malicious files, leading to further exploitation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict file upload types and sizes in your application settings. However, this does not fully mitigate the vulnerability and should only be considered until a proper patch is applied.
Conclusion
In summary, CVE-2026-7733 is a significant vulnerability in Funadmin that allows for unrestricted file uploads due to improper access control. It is crucial to update to a patched version to secure your application and prevent potential exploitation.
See every vulnerability recorded for funadmin/funadmin →
FAQ
CVE-2026-7733 is a vulnerability in Funadmin that allows unauthorized file uploads due to improper access control.
Versions of Funadmin up to 7.1.0-rc6 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The CVSS score of this vulnerability is 7.3, indicating a moderate level of severity.
If you cannot update immediately, implement strict file type and size restrictions as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
