---
id: "CVE-2026-4337"
kind: "vulnerability"
aliases: ["CVE-2026-4337"]
title: "PuMuKIT: unauthenticated file upload to any path enables server takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pumukit", "fixed": [], "affected": "< 5.0.8", "ecosystem": "packagist"}]
ecosystems: []
tags: ["package", "php", "pumukit", "self-hosted"]
not_affected_if: []
published_at: "2026-10-27T12:17:08+00:00"
first_seen_at: "2026-10-27T12:31:38+00:00"
updated_at: "2026-10-27T12:33:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4337", "first_seen_at": "2026-10-27T12:31:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T12:33:09+00:00"}]
---

# PuMuKIT: unauthenticated file upload to any path enables server takeover

Self-hosted PuMuKIT video platform installs reachable over the network, running versions before 5.0.8 per INCIBE, are exposed. An unauthenticated attacker can upload any file type to any path the web server user can write, and can also delete files, which can lead to server takeover. Hosted instances run by someone else, or instances not reachable from untrusted networks, have less exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:pumukit affected < 5.0.8 fixed ?

## How to check

Check installed version (composer show pumukit/pumukit, or the version in your deployment/Docker image); versions below 5.0.8 are listed as affected by INCIBE. Exact vulnerable endpoint not published.

## Fix

Unknown: INCIBE reports no solution at this time. Watch github.com/pumukit/pumukit; Packagist lists 5.1.15 (2026-10-21) but no vendor page confirms it fixes this. Until clear, restrict access to the instance (VPN/IP allowlist or proxy auth) and make upload dirs non-executable.

## Timeline

- 2026-10-27T12:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-4337
- 2026-10-27T12:33:09+00:00 analyst — INCIBE-CERT (coordinator) advisory 27/10/2026: PuMuKIT < 5.0.8 affected, CVSS4 8.8, CWE-434, unauth; INCIBE says no solution reported. No vendor advisory/release notes found on GitHub; endpoint and exact fixed version unconfirmed. No exploitation or PoC seen. Nothing marked verified.

## Documents

- [advisory] INCIBE-CERT: Unrestricted Upload of File in PuMuKIT application https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-pumukit-application

## From the sources

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_