Public upload endpoint accepts unrestricted file types
Summary
The application upload endpoints configure only a destination directory and retain ThinkPHP's permissive default file policy. The public Home upload action accepts arbitrary extensions, MIME types, and sizes.
Affected version
Commit f72cf46f601efb2a0618c3814cc2f61380b38930.
Root cause and location
App/Home/Controller/UserController.class.php:60-74, App/Admin/Controller/ChapterController.class.php:57-70, and App/Admin/Controller/AdController.class.php:43-56 call Think\\Upload::upload() after setting only rootPath. ThinkPHP/Library/Think/Upload.class.php:17-31 defaults mimes=[], exts=[], and maxSize=0; checks at lines 285-305 and 342-360 allow all when these values are empty. The Home action has no authentication.
Reproduction
Use a harmless PHP marker in an isolated Local-driver deployment where ./image/ is web served:
<?php echo 'AUDIT-RCE-OK:' . phpversion();
curl -F 'Filedata=@upload_probe.php;type=application/x-httpd-php' \
http://TARGET/index.php/Home/User/upload
The audited Local-driver test saved image/2026-07-17/6a59d21387bd0.php. Requesting that generated filename returned:
The filename is randomized. In the committed SAE configuration, the confirmed result is arbitrary object upload; do not claim PHP execution unless the deployment's storage URL is proven to execute PHP. Capture the upload request and generated-file response in a terminal screenshot.
Impact
Attackers can upload arbitrary objects. On conventional local PHP hosting with an executable upload directory, this becomes unauthenticated remote code execution. It can also support storage abuse and malicious-file hosting in object-storage deployments.
Remediation
Require authentication and authorization, allowlist extensions and verified MIME/content types, impose a size limit, generate server-side names, and store files outside the executable web root. Configure the web server to never execute uploads.
Public upload endpoint accepts unrestricted file types
Summary
The application upload endpoints configure only a destination directory and retain ThinkPHP's permissive default file policy. The public Home upload action accepts arbitrary extensions, MIME types, and sizes.
Affected version
Commit
f72cf46f601efb2a0618c3814cc2f61380b38930.Root cause and location
App/Home/Controller/UserController.class.php:60-74,App/Admin/Controller/ChapterController.class.php:57-70, andApp/Admin/Controller/AdController.class.php:43-56callThink\\Upload::upload()after setting onlyrootPath.ThinkPHP/Library/Think/Upload.class.php:17-31defaultsmimes=[],exts=[], andmaxSize=0; checks at lines 285-305 and 342-360 allow all when these values are empty. The Home action has no authentication.Reproduction
Use a harmless PHP marker in an isolated Local-driver deployment where
./image/is web served:curl -F 'Filedata=@upload_probe.php;type=application/x-httpd-php' \ http://TARGET/index.php/Home/User/uploadThe audited Local-driver test saved
image/2026-07-17/6a59d21387bd0.php. Requesting that generated filename returned:The filename is randomized. In the committed SAE configuration, the confirmed result is arbitrary object upload; do not claim PHP execution unless the deployment's storage URL is proven to execute PHP. Capture the upload request and generated-file response in a terminal screenshot.
Impact
Attackers can upload arbitrary objects. On conventional local PHP hosting with an executable upload directory, this becomes unauthenticated remote code execution. It can also support storage abuse and malicious-file hosting in object-storage deployments.
Remediation
Require authentication and authorization, allowlist extensions and verified MIME/content types, impose a size limit, generate server-side names, and store files outside the executable web root. Configure the web server to never execute uploads.