CVE-2026-2113: Tpadmin WebUploader Preview Component Deserialization Vulnerability

Overview

This record describes a vulnerability in the WebUploader component bundled with yuan1994 tpadmin, affecting versions up to 1.3.12. The affected file is the preview script under the WebUploader server directory of version 0.1.5. The description refers to deserialization, while the assigned weakness type is CWE-434 (Unrestricted Upload of File with Dangerous Type). The sources consulted do not reconcile these two descriptions.

Impact

NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network access, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The CNA (VulDB) provides a separate CVSS 3.1 score of 7.3, a CVSS 4.0 score of 5.5 and a CVSS 2.0 score of 7.5. The actual impact depends on whether the vulnerable file is reachable in a deployment.

Affected products and versions

Product: Tpadmin Project Tpadmin
Affected versions: up to and including 1.3.12
Affected component: WebUploader, file /public/static/admin/lib/webuploader/0.1.5/server/preview.php

No fixed version is listed in the record. The description states that the vulnerability only affects products no longer supported by the maintainer, so organizations should confirm whether their deployment is still maintained.

Exploitation status

The CISA KEV catalog does not list this CVE, so no active exploitation is confirmed by that source. The record states that an exploit has been publicly disclosed and one reference is tagged as an exploit-related third-party advisory. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.02443 with a percentile of 0.83914.

Remediation and mitigation

Identify every tpadmin instance and confirm the installed version against the affected range.
Because no fixed version is listed and the product may be unsupported, plan a migration to a supported product or a maintained replacement.
Until remediation is possible, restrict or remove public access to the WebUploader files and the preview script, and place the administrative area behind network controls.
Review whether file upload and preview features are necessary and disable them where they are not.

Detection guidance

Review web server logs for requests to the WebUploader path, especially from unexpected sources or with unusual frequency.
Monitor for newly created or modified files in web-accessible upload and library directories.
Check for unexpected processes or outbound connections originating from the web server account.

Limitations of the available information

The sources do not provide a fixed version, a vendor advisory from the project maintainer, or a detailed technical description of the flaw. The discrepancy between the deserialization description and the CWE-434 classification is unresolved. Affected versions are taken from the CNA-provided range. The record's publication date and the EPSS date should be verified against the original sources.

Frequently asked questions

Which versions of tpadmin are affected by CVE-2026-2113?

The record lists tpadmin versions up to and including 1.3.12 from Tpadmin Project as affected. No fixed version is listed in the sources consulted.

Is CVE-2026-2113 known to be actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that an exploit has been publicly disclosed.

What should administrators do now?

Confirm whether the installed version is affected, restrict public access to the WebUploader files, and plan a migration to a supported product because the record indicates the affected product is no longer maintained.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.