Live › vulnerability › CVE-2026-4337
Go to dashboardSelf-hosted PuMuKIT video platform installs reachable over the network, running versions before 5.0.8 per INCIBE, are exposed. An unauthenticated attacker can upload any file type to any path the web server user can write, and can also delete files, which can lead to server takeover. Hosted instances run by someone else, or instances not reachable from untrusted networks, have less exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 12:31 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pumukit | packagist | < 5.0.8 | – |
5.0.8 are listed as affected by INCIBE5.1.15 (2026-10-21) but no vendor page confirms it fixes thisEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
This page as .md · .json · in your agent: get_signal("CVE-2026-4337")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.