CVE-2026-2113
📋 TL;DR
This CVE describes a remote code execution vulnerability in yuan1994 tpadmin's WebUploader component through insecure deserialization in preview.php. Attackers can exploit this to execute arbitrary code on affected systems. Only affects tpadmin versions up to 1.3.12, which are no longer supported by the maintainer.
💻 Affected Systems
- yuan1994 tpadmin
📦 What is this software?
Tpadmin by Tpadmin Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to web server compromise, data exfiltration, or deployment of web shells.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and input validation are in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available as product is no longer supported. Consider migrating to supported alternative or implementing workarounds.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to the vulnerable preview.php file using web server configuration
# Apache: RewriteRule ^/public/static/admin/lib/webuploader/0.1.5/server/preview\.php$ - [F]
# Nginx: location ~ /public/static/admin/lib/webuploader/0.1.5/server/preview\.php$ { deny all; }
Remove vulnerable file
linuxDelete or rename the vulnerable preview.php file
rm /path/to/public/static/admin/lib/webuploader/0.1.5/server/preview.php
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Deploy web application firewall with rules to block deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /public/static/admin/lib/webuploader/0.1.5/server/preview.php and version is ≤1.3.12Check Version:
Check tpadmin version in configuration files or admin interfaceVerify Fix Applied:
Verify preview.php is inaccessible or removed, and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to preview.php
- PHP deserialization errors in logs
- Suspicious file upload attempts
Network Indicators:
- HTTP requests to /public/static/admin/lib/webuploader/0.1.5/server/preview.php with serialized data
SIEM Query:
source="web_logs" AND uri="/public/static/admin/lib/webuploader/0.1.5/server/preview.php" AND (method="POST" OR contains(body, "O:"))