CVE-2026-94838
Action attachments are stored with no file extension validation
| CVE | CVE-2026-94838 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (main_login.php:1349-1354) |
| CWE | CWE-434 |
| CVSS 3.1 | 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
Submission uploads check an allowlist. The action-attachment path checks nothing: main_login.php:1319 calls upload() and then tests only for upload errors and size. The original extension is preserved when the file is renamed to action_<id>.<ext> at main_login.php:694, and action_id is sequential.
Any staff account reaches it: admin and editor unconditionally, and an active 1–active 5 account whenever its group digit appears in the chosen action type's access_groups (main_login.php:1334). Attach shell.php, fetch action_<n>.php. Permanent file, guessable name, no validation.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94838.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch