CVE-2026-16451 Details
Description
A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing unrestricted file extension uploads has been identified in ZS-Admin versions through b52e14536d59fda11e56e2536a1c32e82a38cead. The issue resides in the file upload endpoint of the file management module, specifically within the SysFileController component. The vulnerability allows authenticated users to upload files with arbitrary extensions, such as .svg, .html, or .jsp, without any validation of the file type or content. This could lead to various security issues, including stored cross-site scripting, if the uploaded files are accessed through their URLs and the browser renders them inline.
It is recommended to implement validation for file extensions, MIME types, and file signatures before processing uploads. Additionally, uploaded files should be served as attachments rather than inline, unless specific conditions require otherwise.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zsadmin2025/zs-admin-java/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-16451 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/858792 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/380830 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/380830/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zsadmin2025 ZS-Admin | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |