CVE-2026-82524 is a high-severity authenticated file upload vulnerability leading to remote code execution in UnoPim, an open-source Product Information Management (PIM) platform built on Laravel that organizations use to centrally manage and enrich product data, including catalogs of over 10 million products across multiple sales channels. The flaw is in UnoPim's TinyMCE image upload endpoint, which is missing proper file extension and MIME type validation. An authenticated administrator-level user can abuse this endpoint to upload an arbitrary PHP web shell to the application's public storage disk, then execute arbitrary operating-system commands on the server simply by accessing the uploaded file at the URL the server itself returns in its response.

The following version(s) are affected:

UnoPim before 2.1.5 – (Affected)
UnoPim 2.1.5 and later – (Not affected, patched)

UnoPim is typically self-hosted rather than centrally auto-updated by the vendor, so this fix will not reach an existing deployment on its own. Organizations should confirm the running version directly via the UnoPim admin console or deployment configuration.

Typical attack flow:

1. Upload a malicious PHP file via the TinyMCE image upload endpoint — An attacker who already holds administrator-level credentials to a reachable UnoPim instance uses the TinyMCE image upload endpoint which does not properly validate file extension or MIME type to upload a PHP web shell disguised as an image to the application's public storage disk.
2. Access the uploaded file to execute arbitrary commands — The attacker retrieves the URL to the uploaded file from the server's own response and accesses it directly, causing the PHP web shell to execute and giving the attacker the ability to run arbitrary operating-system commands on the underlying server.

Attack vectors:

• Requires the attacker to already hold administrator-level credentials to a reachable UnoPim instance (CVSS PR:H) - this is not exploitable by an anonymous, unauthenticated attacker with no account.
• No user interaction is required beyond that authenticated access (CVSS UI:N). CERTVU is not aware of confirmed active exploitation at the time of writing, but the technical details and a proof-of-concept-style researcher writeup are now public, and the practical impact of a successful attack (full server-side remote code execution) is severe.

Successful exploitation may allow attackers to:

• Execute arbitrary operating-system commands on the server hosting UnoPim, achieving full remote code execution.
• Access, exfiltrate, or tamper with the product catalog and any other data managed through UnoPim, and use the compromised server as a foothold into other systems on the same network.

CERTVU recommends the following:

1. Apply the Vendor Patch Without Delay

   Upgrade UnoPim to version 2.1.5 or later, where this vulnerability is fixed as part of the vendor's own file-upload security hardening. Because UnoPim is self-hosted, this requires a deliberate upgrade - confirm the running instance has actually reached the fixed version.

2. Review Administrator-Level Access

   Review which accounts hold administrator-level access to UnoPim, since this vulnerability can only be exploited by an already-authenticated administrator.

3. Audit the Estate for UnoPim Deployments

   Audit the estate for UnoPim deployments.

4. Treat Unpatched Instances as Potentially Compromised

   Treat any unpatched instance with untrusted administrator access as potentially compromised.

5. Rotate Credentials and Review Uploaded Files

   Rotate credentials and review uploaded files.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.