Medium severity6.5NVD Advisory· Published Aug 25, 2026· Updated Sep 24, 2026
CVE-2026-80050
CVE-2026-80050
Description
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=4.1.0
Patches
Vulnerability mechanics
References
3- github.com/continew-org/continew-admin/blob/v4.1.0/continew-system/src/main/java/top/continew/admin/system/controller/MultipartUploadController.javanvd
- github.com/continew-org/continew-admin/issues/221nvd
- www.vulncheck.com/advisories/continew-admin-through-4.1.0-missing-authorization-and-file-type-allowlist-on-multipart-upload-endpointsnvd
News mentions
0No linked articles in our index yet.