CVE-2026-6650
MEDIUMZ-BlogPHP ZBA File app_upload.php UnPack unrestricted upload
Title source: cnaDescription
A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
CVSS v3
4.7
EPSS
0.0003
EPSS Percentile
9.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-284
CWE-434
Status
published
Products (1)
None/Z-BlogPHP
1.7.5
Published
Apr 20, 2026
Tracked Since
Apr 20, 2026