{"id":"CVE-2026-4337","kind":"vulnerability","aliases":["CVE-2026-4337"],"related":[],"title":"PuMuKIT: unauthenticated file upload to any path enables server takeover","description":"Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.","summary":"Self-hosted PuMuKIT video platform installs reachable over the network, running versions before 5.0.8 per INCIBE, are exposed. An unauthenticated attacker can upload any file type to any path the web server user can write, and can also delete files, which can lead to server takeover. Hosted instances run by someone else, or instances not reachable from untrusted networks, have less exposure.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pumukit","fixed":[],"affected":"< 5.0.8","ecosystem":"packagist"}],"ecosystems":[],"tags":["package","php","pumukit","self-hosted"],"not_affected_if":[],"how_to_check":"Check installed version (composer show pumukit/pumukit, or the version in your deployment/Docker image); versions below 5.0.8 are listed as affected by INCIBE. Exact vulnerable endpoint not published.","fix":"Unknown: INCIBE reports no solution at this time. Watch github.com/pumukit/pumukit; Packagist lists 5.1.15 (2026-10-21) but no vendor page confirms it fixes this. Until clear, restrict access to the instance (VPN/IP allowlist or proxy auth) and make upload dirs non-executable.","status":"open","published_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:31:56+00:00","updated_at":"2026-10-27T12:33:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T12:31:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PuMuKIT: unauthenticated file upload to any path enables server takeover","impact":"high","summary":"PuMuKIT has an unrestricted file upload flaw that lets an unauthenticated user upload files of any type. Uploads can land anywhere the web server user can write, and the same flaw can be used to delete files.","category":"package","nicknames":[],"who_cares":["pumukit","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker uploads executable files to the server and deletes files","analyst_note":"Find the affected PuMuKIT versions, the vulnerable upload endpoint, and the fixed release in the NVD entry or the upstream repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":3304,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected PuMuKIT versions, the vulnerable upload endpoint, and the fixed release in the NVD entry or the upstream repository.","search":"'-2026':12A,15A '-4337':13A,16A '5.0.8':38B 'allow':99C,127C 'also':62B,126C 'applic':98C 'attack':45B 'could':125C 'cve':11A,14A 'danger':92C 'delet':63B,130C 'els':76B 'enabl':8A 'expos':42B 'exposur':86B 'file':3A,49B,64B,90C,108C,131C 'host':23B,26B,71B 'incib':40B 'instal':30B 'instanc':72B,78B 'lead':67B 'less':85B 'network':34B,83B 'packag':18B 'path':7A,53B,115C 'per':39B 'permiss':123C 'php':19B 'platform':29B 'pumukit':1A,17A,20B,27B,97C 'reachabl':31B,80B 'run':35B,73B 'self':22B,25B 'self-host':21B,24B 'server':9A,56B,69B,111C,119C 'someon':75B 'takeov':10A,70B 'type':50B,93C,106C 'unauthent':2A,44B,101C 'unrestrict':87C 'untrust':82B 'upload':4A,47B,88C,104C 'user':57B,102C,120C 'version':36B 'video':28B 'vulner':94C 'web':55B,118C 'write':59B,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-4337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4337","severity":null,"published_at":"2026-10-27T12:17:08+00:00","modified_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-4337:871","url":null,"severity":null,"published_at":"2026-10-27T12:33:09+00:00","modified_at":"2026-10-27T12:33:09+00:00","first_seen_at":"2026-10-27T12:33:09+00:00","fetched_at":"2026-10-27T12:33:09+00:00","note":"INCIBE-CERT (coordinator) advisory 27/10/2026: PuMuKIT < 5.0.8 affected, CVSS4 8.8, CWE-434, unauth; INCIBE says no solution reported. No vendor advisory/release notes found on GitHub; endpoint and exact fixed version unconfirmed. No exploitation or PoC seen. Nothing marked verified."}],"documents":[{"id":6302,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-pumukit-application","title":"INCIBE-CERT: Unrestricted Upload of File in PuMuKIT application","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}