Description (CNA)
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| 4real / ThemisNETPanel | affected 0 before 04.2026 |
CWE
CWE-306
References
ADP enrichment
No English description supplied.
No references supplied.