CVE-2026-6650

MEDIUM

Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload

Title source: cna
STIX 2.1

Description

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-358284 | Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload
https://vuldb.com/vuln/358284
Signature, Permissions Required signature permissions-required
VDB-358284 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358284/cti
Third Party Advisory third-party-advisory
Submit #793451 | Z-Blog Z-BlogPHP 1.7.5 Upload any file
https://vuldb.com/submit/793451

Scores

CVSS v3 4.7
EPSS 0.0022
EPSS Percentile 12.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284 CWE-434
Status published
Products (1)
None/Z-BlogPHP 1.7.5
Published Apr 20, 2026
Tracked Since Apr 20, 2026