High severity7.2NVD Advisory· Published Mar 10, 2022· Updated Jun 17, 2026

CVE-2022-26521

Description

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AbanteCart/AbanteCartcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.3.2
osv-coords
pkg:bitnami/abantecart
Range: < 1.3.2

Patches

Vulnerability mechanics

References

github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txtnvdExploitThird Party Advisory
packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.008
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000