Description
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-10-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unrestricted Upload leading to possible Remote Code Execution
Action: Patch
AI Analysis

Impact

The flaw lies in the ZipArchive::extractTo function within the Plugin Installer module of arizu-id fast-tunnel. Manipulating the plugin_file argument allows an actor to upload any file to the server with no restrictions, creating an access‑control bypass (CWE‑284) and an unrestricted upload scenario (CWE‑434). If a malicious file is placed in a web‑accessible location, it could be executed, compromising confidentiality, integrity and availability of the host system. The vulnerability demonstrates that data supplied by a remote user can influence a file extraction destination without validation.

Affected Systems

The affected product is arizu-id fast‑tunnel version 1.0.0. The Plugin Installer component is vulnerable; version 1.0.1 includes a patch that removes the flaw.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available. The vulnerability is not listed in the CISA KEV catalog and may be leveraged remotely. Because the exploit is publicly disclosed and the vendor has issued a patch, the risk is elevated for environments still running the vulnerable version.

Generated by OpenCVE AI on October 20, 2026 at 14:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade fast‑tunnel to version 1.0.1 or later to apply the vendor patch.
  • If an immediate upgrade is not possible, limit the upload directory to a safe location and verify the file type to prevent arbitrary files from being written.
  • Audit the Plugin Installer code to ensure no other extraction functions accept unvalidated paths, and monitor logs for suspicious ZipArchive usage to detect attempts to abuse the upload path.

Generated by OpenCVE AI on October 20, 2026 at 14:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
First Time appeared Arizu-id
Arizu-id fast-tunnel
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:arizu-id:fast-tunnel:*:*:*:*:*:*:*:*
Vendors & Products Arizu-id
Arizu-id fast-tunnel
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Arizu-id Fast-tunnel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T10:15:19.899Z

Reserved: 2026-10-20T04:28:44.663Z

Link: CVE-2026-113382

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T11:17:20.600

Modified: 2026-10-20T11:17:20.600

Link: CVE-2026-113382

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T15:00:19Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type