Description
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
Published: 2026-07-13
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ThemisNETPanel allows an unauthenticated attacker to upload and execute arbitrary PHP files by posting a base64‑encoded payload to an unsecured endpoint. The lack of authentication makes the vulnerability a direct path to remote code execution, taking full control of the underlying server. The weakness is classified as CWE‑306 'Missing Authentication'.

Affected Systems

ThemisNETPanel, developed by 4real, is affected in all releases prior to the April 2026 patch. No other versions have been confirmed to contain the flaw.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical severity. Exploitation requires only an unauthenticated HTTP POST to the upload URL; no privileged access is needed. The EPSS score of < 1% suggests a very low but nonzero exploitation probability; the lack of authentication increases the risk, but no publicly documented exploit is indicated by the data provided. The issue is not currently listed in the CISA KEV catalog, but the potential impact warrants immediate remediation.

Generated by OpenCVE AI on July 31, 2026 at 11:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the April 2026 patch for ThemisNETPanel to enforce authentication on the file upload endpoint.
  • Configure the web server or firewall to block POST requests to the upload URL from unauthenticated users and monitor logs for unauthorized upload attempts.
  • Restrict the upload directory’s file permissions to prevent execution of any uploaded files, and enable logging to detect potential breach activity.

Generated by OpenCVE AI on July 31, 2026 at 11:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared 4real
4real themisnetpanel
Vendors & Products 4real
4real themisnetpanel

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Description Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
Title Unauthenticated Remote Code Execution in ThemisNETPanel
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}

Subscriptions

4real Themisnetpanel
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-14T14:32:08.791Z

Reserved: 2026-04-22T08:08:03.689Z

Link: CVE-2026-6847

cve-icon Vulnrichment

Updated: 2026-07-14T14:22:07.807Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:45:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function