EIP-2026-112914

PRE-CVE

Uploader by CeleronDude 5.3.0 - Arbitrary File Upload (2)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112914. PoCs published by Stink'.

AI-analyzed exploit summary The exploit demonstrates an upload vulnerability in Uploader by CeleronDude 5.3.0, allowing arbitrary file upload by renaming a shell to a .pjpeg extension. It also reveals a method to retrieve the admin password from an exposed settings.db file.

Description

Uploader by CeleronDude 5.3.0 - Arbitrary File Upload (2)

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stink' · textwebappsphp
https://www.exploit-db.com/exploits/11166

The exploit demonstrates an upload vulnerability in Uploader by CeleronDude 5.3.0, allowing arbitrary file upload by renaming a shell to a .pjpeg extension. It also reveals a method to retrieve the admin password from an exposed settings.db file.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Uploader by CeleronDude 5.3.0
No auth needed
Prerequisites: Access to the upload functionality · Exposed settings.db file
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026