Cyber Resilience

CVE-2025-15426

Medium

Published: 02 January 2026

Published
02 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0001 1.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15426 is a medium-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-15426 is a vulnerability identified in jackying H-ui.admin versions up to 3.1, specifically affecting an unknown function within the /lib/webuploader/0.1.5/server/preview.php library component. The issue enables unrestricted file upload (CWE-284: Improper Access Control; CWE-434: Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows manipulation leading to unrestricted uploads, potentially enabling further compromise such as remote code execution, as demonstrated in publicly available proof-of-concept exploits.

Advisories from VulDB (ctiid.339348, id.339348, submit.721457) and GitHub repositories by TiKi-r detail the issue, including a proof-of-concept for H-ui.admin RCE, but note that the vendor was contacted early for disclosure and did not respond. No patches or official mitigations are referenced.

The exploit is publicly available and might be used in the wild, with no additional real-world exploitation status reported.

EU & UK References

Vulnerability details

A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and…

more

might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted file upload in a public-facing web app directly enables exploitation for initial access (T1190) and deployment of a web shell (T1505.003) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13144Shared CWE-284, CWE-434
CVE-2025-8255Shared CWE-284, CWE-434
CVE-2025-2219Shared CWE-284, CWE-434
CVE-2025-7413Shared CWE-284, CWE-434
CVE-2025-0341Shared CWE-284, CWE-434
CVE-2026-3748Shared CWE-284, CWE-434
CVE-2026-2666Shared CWE-284, CWE-434
CVE-2026-2979Shared CWE-284, CWE-434
CVE-2026-3800Shared CWE-284, CWE-434
CVE-2025-1355Shared CWE-284, CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces access restrictions on the preview.php upload endpoint to block unauthenticated remote file manipulation.

prevent

Requires validation of uploaded file types and content to stop unrestricted dangerous file uploads at the webuploader component.

preventdetect

Deploys malicious code detection mechanisms that can identify and block execution of files uploaded via the vulnerable preview.php path.

References