Description
A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-02-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A deserialization flaw in the preview.php script of the WebUploader component used by yuan1994 tpadmin allows an attacker to submit crafted input that is processed without proper validation. The vulnerability can lead to execution of arbitrary code on the web server, compromising confidentiality, integrity, and availability of the affected system.

Affected Systems

All releases of yuan1994 tpadmin up through version 1.3.12 are affected. The component is identified by the CPE cpe:2.3:a:tpadmin_project:tpadmin and is no longer supported by the maintainer, so no official updates are expected for older versions.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating moderate severity. EPSS is below 1%, suggesting a low overall exploitation probability at present. It is not listed in the CISA KEV catalog. Attack execution requires remote access, most likely via HTTP requests to the preview.php endpoint, and relies on the ability to send malicious serialized payloads.

Generated by OpenCVE AI on April 17, 2026 at 22:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade tpadmin to a version with the deserialization fix, or apply a vendor‑supplied patch if available.
  • If an upgrade is not possible, restrict access to /public/static/admin/lib/webuploader/0.1.5/server/preview.php so only trusted administrators can use it, and block external traffic.
  • If the WebUploader component is not required, disable or remove it and replace it with a secure file‑upload library that validates and sanitizes input, adhering to CWE‑502 and CWE‑20 best practices.
  • Continuously monitor application logs for signs of deserialization attempts or arbitrary code execution, and enforce strict input validation policies.

Generated by OpenCVE AI on April 17, 2026 at 22:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Tpadmin Project
Tpadmin Project tpadmin
Weaknesses CWE-434
CPEs cpe:2.3:a:tpadmin_project:tpadmin:*:*:*:*:*:*:*:*
Vendors & Products Tpadmin Project
Tpadmin Project tpadmin

Tue, 10 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Yuan1994
Yuan1994 tpadmin
Vendors & Products Yuan1994
Yuan1994 tpadmin

Sat, 07 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Title yuan1994 tpadmin WebUploader preview.php deserialization
Weaknesses CWE-20
CWE-502
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tpadmin Project Tpadmin
Yuan1994 Tpadmin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:34:51.326Z

Reserved: 2026-02-06T14:37:20.590Z

Link: CVE-2026-2113

cve-icon Vulnrichment

Updated: 2026-02-10T16:14:48.851Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-07T21:15:45.697

Modified: 2026-03-05T20:34:50.280

Link: CVE-2026-2113

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T22:15:29Z

Weaknesses