CVE-2026-116113 Details

A vulnerability allowing unrestricted file uploads has been identified in GouGuOA versions through 6.1.2. The issue arises in the 'chunkUpload' function of 'app/disk/controller/Api.php', where the 'file_extension' argument is not properly validated. This flaw enables authenticated employees to upload files with dangerous extensions, such as PHP, which can then be executed on the server. The vulnerability can be exploited remotely, and a public exploit is available.

To address this vulnerability, GouGuOA should enforce a proper extension whitelist on uploaded files, ensuring that only safe file types are accepted. Additionally, the application should normalize file parameters to prevent directory traversal attacks, move storage locations out of the web root, and implement a cleanup process to remove any previously exploited files.